@mavonengine/cli 0.0.2 → 0.0.3

package/dist/index.js

@@ -1,23 +1,30 @@
 #!/usr/bin/env node
+import {
+  PLUGIN_REGISTRY_ENV,
+  PLUGIN_REGISTRY_URL,
+  SUPPORTED_REGISTRY_VERSION,
+  fetchPluginRegistry,
+  notInProject
+} from "./chunk-ZEMFSSJP.js";
 import {
   DEFAULT_DOCS_URL,
   MCP_CONFIG_FILE,
   version,
   writeMcpConfig
-} from "./chunk-TNN4S5K4.js";
+} from "./chunk-XPKCYSMN.js";
 
 // src/index.ts
-import process9 from "process";
+import process11 from "process";
 
 // src/commands/build.ts
-import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join3, resolve as resolve3 } from "path";
-import process4 from "process";
-import { parseArgs as parseArgs3 } from "util";
+import { spawn as spawn4 } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join5, resolve as resolve5 } from "path";
+import process7 from "process";
+import { parseArgs as parseArgs4 } from "util";
 
 // ../core/dist/Plugins/ProjectConfig.js
-import { existsSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "fs";
 import { dirname, isAbsolute, join, relative, resolve } from "path";
 var CONFIG_FILE = "mavonengine.json";
 var TARGETS = ["client", "server", "both"];
@@ -26,6 +33,14 @@ var PluginConfigError = class extends Error {
 function configPath(root) {
   return join(root, CONFIG_FILE);
 }
+function findConfigRoot(start) {
+  for (let dir = resolve(start); ; dir = dirname(dir)) {
+    if (existsSync(configPath(dir)))
+      return dir;
+    if (dirname(dir) === dir)
+      return void 0;
+  }
+}
 function readConfig(root) {
   const path = configPath(root);
   if (!existsSync(path))
@@ -168,7 +183,7 @@ function releaseAssets(root) {
 }
 
 // src/commands/dashboard.ts
-import process2 from "process";
+import process3 from "process";
 import { parseArgs } from "util";
 
 // src/browser.ts
@@ -205,6 +220,39 @@ async function servesPage(url, { timeoutMs = 3e3, fetch = globalThis.fetch } = {
   }
 }
 
+// src/dashboard/available.ts
+import process2 from "process";
+var AvailablePlugins = class {
+  constructor(url = process2.env[PLUGIN_REGISTRY_ENV] ?? PLUGIN_REGISTRY_URL, fetchRegistry = (registryUrl) => fetchPluginRegistry({ url: registryUrl })) {
+    this.fetchRegistry = fetchRegistry;
+    this.state = { status: "idle", url, plugins: [], error: null };
+  }
+  fetchRegistry;
+  state;
+  listeners = /* @__PURE__ */ new Set();
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Fetch the list if it wasn't yet. With `force` it is fetched again, keeping what is shown until the answer is in.
+   */
+  load(force = false) {
+    const { state } = this;
+    if (state.status === "loading" || state.status !== "idle" && !force)
+      return Promise.resolve();
+    state.status = "loading";
+    return this.fetchRegistry(state.url).then(({ plugins }) => {
+      state.plugins = plugins;
+      state.error = null;
+      state.status = "ready";
+    }, (err) => {
+      state.error = err.message;
+      state.status = "error";
+    }).then(() => this.listeners.forEach((listener) => listener()));
+  }
+};
+
 // src/dashboard/snapshot.ts
 var SUPPORTED_SCHEMA_VERSION = 1;
 function isRecord(value) {
@@ -335,10 +383,108 @@ function normalizeRequests(raw) {
     latestId: num(r.latestId, entries.at(-1)?.id ?? 0)
   };
 }
+function normalizePackets(raw) {
+  const r = section(raw);
+  const entries = arr(r.records, (e) => ({
+    id: num(e.id),
+    timestamp: num(e.timestamp),
+    kind: e.kind === "event" ? "event" : "packet",
+    direction: e.direction === "in" || e.direction === "out" ? e.direction : null,
+    type: str(e.type, "?"),
+    peer: strOrNull(e.peer),
+    bytes: num(e.bytes),
+    tick: numOrNull(e.tick),
+    sequenceId: numOrNull(e.sequenceId),
+    reliable: e.reliable === true,
+    info: section(e.info)
+  }));
+  return {
+    entries,
+    latestId: num(r.latestId, entries.at(-1)?.id ?? 0)
+  };
+}
+function normalizeSync(raw) {
+  const r = section(raw);
+  const players = arr(r.players, (p) => {
+    const lastState = isRecord(p.lastState) ? p.lastState : null;
+    return {
+      id: str(p.id),
+      displayName: str(p.displayName, str(p.id)),
+      tracked: Array.isArray(p.tracked) ? p.tracked.length : 0,
+      ack: num(p.ack),
+      lastState: lastState && { tick: num(lastState.tick), bytes: num(lastState.bytes), entities: num(lastState.entities) }
+    };
+  });
+  const entities = arr(r.entities, (e) => ({ player: e.player === true, trackedBy: num(e.trackedBy) }));
+  return {
+    tick: num(r.tick),
+    tickRate: num(r.tickRate),
+    syncDistance: numOrNull(r.syncDistance),
+    entities: entities.length,
+    // Without players nothing is tracked, which says nothing about the entities
+    untracked: players.length ? entities.filter((e) => !e.player && e.trackedBy === 0).length : 0,
+    editors: Array.isArray(r.editors) ? r.editors.length : 0,
+    players
+  };
+}
+function normalizePacketDetail(id, raw) {
+  const record = section(raw).record;
+  if (!isRecord(record))
+    return { id, status: "gone", lines: [] };
+  const lines = (value) => JSON.stringify(value, null, 2).split("\n");
+  if (record.payload !== void 0 && record.payload !== null)
+    return { id, status: "loaded", lines: lines(record.payload) };
+  if (record.kind === "event" && isRecord(record.info))
+    return { id, status: "loaded", lines: lines(record.info) };
+  if (record.kind !== "event" && num(record.bytes) > 0)
+    return { id, status: "gone", lines: [] };
+  return { id, status: "empty", lines: [] };
+}
+function descriptions(value) {
+  if (!isRecord(value))
+    return void 0;
+  return Object.fromEntries(Object.entries(value).map(([name, description]) => [name, str(description)]));
+}
+function normalizeRoutes(raw) {
+  return arr(section(raw).routes, (r) => {
+    const source = r.source === "engine" || r.source === "plugin" ? r.source : "game";
+    const plugin = strOrNull(r.plugin);
+    const query = descriptions(r.query);
+    return {
+      method: str(r.method, "?"),
+      path: str(r.path),
+      source,
+      ...plugin ? { plugin } : {},
+      params: descriptions(r.params) ?? {},
+      devOnly: r.devOnly === true,
+      ...query ? { query } : {},
+      ...Object.fromEntries(["summary", "description", "response", "auth"].filter((key) => typeof r[key] === "string").map((key) => [key, r[key]]))
+    };
+  });
+}
+function strings(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function normalizePlugins(raw) {
+  return arr(section(raw).plugins, (p) => {
+    const target = p.target === "client" || p.target === "server" || p.target === "both" ? p.target : void 0;
+    return {
+      package: str(p.package, "?"),
+      enabled: p.enabled !== false,
+      installed: p.installed !== false,
+      runningOnServer: p.runningOnServer === true,
+      declaredPrefabs: strings(p.declaredPrefabs),
+      usedPrefabs: strings(p.usedPrefabs),
+      ...target ? { target } : {},
+      ...Object.fromEntries(["problem", "version", "description", "license", "homepage", "engine"].filter((key) => typeof p[key] === "string").map((key) => [key, p[key]]))
+    };
+  });
+}
 
 // src/dashboard/MetricsClient.ts
 var MAX_LOG_LINES = 1e3;
 var MAX_REQUEST_LINES = 1e3;
+var MAX_PACKET_LINES = 2e3;
 var MetricsSourceError = class extends Error {
   constructor(message, status) {
     super(message);
@@ -349,6 +495,11 @@ var MetricsSourceError = class extends Error {
 function httpSource({ url, token, timeoutMs = 3e3, fetch = globalThis.fetch }) {
   const logsUrl = new URL("logs", url);
   const requestsUrl = new URL("requests", url);
+  const packetsUrl = new URL("dev/net/packets", url);
+  packetsUrl.searchParams.set("limit", String(MAX_PACKET_LINES));
+  const syncUrl = new URL("dev/net/sync", url);
+  const routesUrl = new URL("routes", url);
+  const pluginsUrl = new URL("plugins", url);
   async function request(target) {
     let res;
     try {
@@ -379,7 +530,15 @@ function httpSource({ url, token, timeoutMs = 3e3, fetch = globalThis.fetch }) {
     fetchRequests: (afterId) => {
       requestsUrl.searchParams.set("after", String(afterId));
       return request(requestsUrl.toString());
-    }
+    },
+    fetchPackets: (afterId) => {
+      packetsUrl.searchParams.set("after", String(afterId));
+      return request(packetsUrl.toString());
+    },
+    fetchSync: () => request(syncUrl.toString()),
+    fetchPacket: (id) => request(new URL(`dev/net/packets/${id}`, url).toString()),
+    fetchRoutes: () => request(routesUrl.toString()),
+    fetchPlugins: () => request(pluginsUrl.toString())
   };
 }
 var Feed = class {
@@ -418,13 +577,16 @@ var Feed = class {
   }
 };
 var MetricsClient = class {
-  constructor(source, { intervalMs = 1e3, maxBackoffMs = 1e4, startupIntervalMs } = {}) {
+  constructor(source, { intervalMs = 1e3, maxBackoffMs = 1e4, startupIntervalMs, routesIntervalMs = 5e3 } = {}) {
     this.source = source;
     this.intervalMs = intervalMs;
+    this.routesIntervalMs = routesIntervalMs;
     this.maxBackoffMs = maxBackoffMs;
     this.startupIntervalMs = startupIntervalMs;
     this.logs = new Feed(source.fetchLogs?.bind(source), normalizeLogs, MAX_LOG_LINES);
     this.requests = new Feed(source.fetchRequests?.bind(source), normalizeRequests, MAX_REQUEST_LINES);
+    this.packets = new Feed(source.fetchPackets?.bind(source), normalizePackets, MAX_PACKET_LINES);
+    this.syncAvailable = !!source.fetchSync;
     this.state = {
       status: "connecting",
       source: source.label,
@@ -435,7 +597,15 @@ var MetricsClient = class {
       logs: [],
       logsAvailable: this.logs.available,
       requests: [],
-      requestsAvailable: this.requests.available
+      requestsAvailable: this.requests.available,
+      packets: [],
+      packetsAvailable: this.packets.available,
+      sync: null,
+      packetDetail: null,
+      routes: [],
+      routesAvailable: source.fetchRoutes ? null : false,
+      plugins: [],
+      pluginsAvailable: source.fetchPlugins ? null : false
     };
   }
   source;
@@ -448,6 +618,46 @@ var MetricsClient = class {
   listeners = /* @__PURE__ */ new Set();
   logs;
   requests;
+  packets;
+  syncAvailable;
+  /**
+   * Follow the packets and the state sync too. Off by default: it is a lot of data on a busy server,
+   * so the dashboard only turns it on while its Network tab is shown.
+   */
+  watchNetwork = false;
+  routesIntervalMs;
+  /** Date.now() the endpoints and plugins were last fetched, null to fetch them with the next poll */
+  projectFetchedAt = null;
+  /**
+   * Load the content of one packet into `state.packetDetail`, or close it with null.
+   */
+  async inspectPacket(id) {
+    if (id === null) {
+      this.state.packetDetail = null;
+      this.notify();
+      return;
+    }
+    if (!this.source.fetchPacket) {
+      this.state.packetDetail = { id, status: "error", lines: [], error: "This source does not serve packet contents" };
+      this.notify();
+      return;
+    }
+    this.state.packetDetail = { id, status: "loading", lines: [] };
+    this.notify();
+    let detail;
+    try {
+      detail = normalizePacketDetail(id, await this.source.fetchPacket(id));
+    } catch (err) {
+      detail = { id, status: "error", lines: [], error: err.message };
+    }
+    if (this.state.packetDetail?.id !== id)
+      return;
+    this.state.packetDetail = detail;
+    this.notify();
+  }
+  notify() {
+    this.listeners.forEach((listener) => listener(this.state));
+  }
   onChange(listener) {
     this.listeners.add(listener);
     return () => this.listeners.delete(listener);
@@ -471,6 +681,7 @@ var MetricsClient = class {
     if (this.timer)
       clearTimeout(this.timer);
     this.timer = null;
+    this.projectFetchedAt = null;
     await this.loop();
   }
   /**
@@ -484,17 +695,71 @@ var MetricsClient = class {
       this.state.lastUpdate = Date.now();
       this.state.error = null;
       this.state.failures = 0;
-      await Promise.all([this.logs.poll(), this.requests.poll()]);
+      await Promise.all([this.logs.poll(), this.requests.poll(), this.pollProject()]);
       this.state.logs = this.logs.entries;
       this.state.logsAvailable = this.logs.available;
       this.state.requests = this.requests.entries;
       this.state.requestsAvailable = this.requests.available;
+      if (this.watchNetwork) {
+        await Promise.all([this.packets.poll(), this.pollSync()]);
+        this.state.packets = this.packets.entries;
+        this.state.packetsAvailable = this.packets.available;
+      }
     } catch (err) {
       this.state.status = err instanceof MetricsSourceError ? err.status : "unreachable";
       this.state.error = err.message;
       this.state.failures++;
     }
-    this.listeners.forEach((listener) => listener(this.state));
+    this.notify();
+  }
+  async pollSync() {
+    if (!this.syncAvailable)
+      return;
+    try {
+      this.state.sync = normalizeSync(await this.source.fetchSync());
+    } catch (err) {
+      if (err instanceof MetricsSourceError && err.status === "disabled") {
+        this.syncAvailable = false;
+        this.state.sync = null;
+      }
+    }
+  }
+  /**
+   * Fetch the server's HTTP endpoints and plugins, unless they were fetched a moment ago
+   */
+  async pollProject(now = Date.now()) {
+    if (this.projectFetchedAt !== null && now - this.projectFetchedAt < this.routesIntervalMs)
+      return;
+    const { source, state } = this;
+    const done = await Promise.all([
+      this.fetchList(state.routesAvailable, source.fetchRoutes?.bind(source), (raw) => {
+        state.routes = normalizeRoutes(raw);
+        state.routesAvailable = true;
+      }, () => state.routesAvailable = false),
+      this.fetchList(state.pluginsAvailable, source.fetchPlugins?.bind(source), (raw) => {
+        state.plugins = normalizePlugins(raw);
+        state.pluginsAvailable = true;
+      }, () => state.pluginsAvailable = false)
+    ]);
+    if (done.every(Boolean))
+      this.projectFetchedAt = now;
+  }
+  /**
+   * Returns false when the list could not be fetched this time but may be next time
+   */
+  async fetchList(available, fetchList, onList, onUnavailable) {
+    if (!fetchList || available === false)
+      return true;
+    try {
+      onList(await fetchList());
+      return true;
+    } catch (err) {
+      if (err instanceof MetricsSourceError && err.status === "disabled") {
+        onUnavailable();
+        return true;
+      }
+      return false;
+    }
   }
   /**
    * Delay before the next poll: the normal interval, doubling per failure up to maxBackoffMs.
@@ -520,6 +785,48 @@ var MetricsClient = class {
 
 // src/dashboard/simulator.ts
 var HISTORY_LENGTH = 60;
+var PACKET_LIMIT = 2e3;
+var STATES_PER_SECOND = 5;
+var SIMULATED_PLUGINS = [
+  {
+    package: "@mavonengine/http-monitoring",
+    enabled: true,
+    installed: true,
+    runningOnServer: true,
+    version: "0.0.1",
+    description: "The game server dashboard in the browser, behind HTTP Basic auth",
+    license: "MIT",
+    target: "server",
+    engine: "^0.0.22",
+    declaredPrefabs: [],
+    usedPrefabs: []
+  },
+  {
+    package: "@acme/forest",
+    enabled: true,
+    installed: true,
+    runningOnServer: false,
+    version: "2.3.1",
+    description: "Trees and rocks to place in a scene",
+    license: "MIT",
+    target: "client",
+    declaredPrefabs: ["Tree", "Rock"],
+    usedPrefabs: ["Tree"]
+  },
+  { package: "chat", enabled: false, installed: true, runningOnServer: false, version: "1.0.0", target: "both", declaredPrefabs: [], usedPrefabs: [] }
+];
+var SIMULATED_ROUTES = [
+  { method: "GET", path: "/api/game/health", source: "engine", params: {}, devOnly: false, summary: "Whether the server is up" },
+  { method: "GET", path: "/api/game/metrics", source: "engine", params: {}, devOnly: false, summary: "Server statistics" },
+  { method: "GET", path: "/api/game/logs", source: "engine", params: {}, devOnly: false, summary: "Recent server log entries" },
+  { method: "GET", path: "/api/game/requests", source: "engine", params: {}, devOnly: false, summary: "Recent HTTP requests to this server" },
+  { method: "GET", path: "/api/game/routes", source: "engine", params: {}, devOnly: false, summary: "Every HTTP endpoint of this server" },
+  { method: "GET", path: "/api/game/dev/scene", source: "engine", params: {}, devOnly: true, summary: "The active scene" },
+  { method: "GET", path: "/api/scores", source: "game", params: {}, devOnly: false, summary: "The high scores" },
+  { method: "POST", path: "/api/scores/:player", source: "game", params: { player: "Id of the player" }, devOnly: false },
+  { method: "GET", path: "/monitoring", source: "plugin", plugin: "@mavonengine/http-monitoring", params: {}, devOnly: false },
+  { method: "GET", path: "/monitoring/api/metrics", source: "plugin", plugin: "@mavonengine/http-monitoring", params: {}, devOnly: false }
+];
 function mulberry32(seed) {
   return () => {
     seed |= 0;
@@ -554,6 +861,15 @@ function simulatedSource(seed = 1, sampleIntervalMs = 1e3) {
   const request = (method, path, status, bytes, address) => {
     requests.push({ id: requests.length + 1, timestamp: now, method, path, status, durationMs: Math.round((1 + random() * 20) * 100) / 100, bytes, address });
   };
+  const packets = [];
+  let packetId = 0;
+  let tick = 0;
+  let syncPlayers = [];
+  const record = (entry, offsetMs = 0) => {
+    packets.push({ id: ++packetId, timestamp: now + offsetMs, hasPayload: entry.kind === "packet", ...entry });
+    if (packets.length > PACKET_LIMIT)
+      packets.shift();
+  };
   log("info", "Starting @mavon/engine - Socket Server");
   log("info", "Starting @mavon/engine - HTTP Server");
   return {
@@ -591,14 +907,48 @@ function simulatedSource(seed = 1, sampleIntervalMs = 1e3) {
         request("GET", "/favicon.ico", 404, 160, address);
         request("POST", "/.wrtc/v2/connections", 200, 2900, address);
         request("POST", `/.wrtc/v2/connections/${players[i].id}/additional-candidates`, 200, 600, address);
+        record({ kind: "event", type: "connect", peer: players[i].id });
+        record({ kind: "packet", direction: "in", type: "cl_init", peer: players[i].id, bytes: 24, reliable: true });
+        record({ kind: "event", type: "sync_enter", peer: players[i].id, tick, info: { count: players[i].trackedEntities } });
         log("info", `Connected: ${players[i].id}`);
         log("info", `${i + 1} total players connected`);
       }
       for (let i = previousPlayers - 1; i >= playerCount; i--) {
+        record({ kind: "event", type: "disconnect", peer: `sim-${(i + 1).toString().padStart(2, "0")}` });
         log("info", `Disconnected sim-${(i + 1).toString().padStart(2, "0")}`);
         log("info", `${i} total players connected`);
       }
       previousPlayers = playerCount;
+      const lastStates = /* @__PURE__ */ new Map();
+      for (let state = 0; state < STATES_PER_SECOND; state++) {
+        const offset = Math.round(state * sampleIntervalMs / STATES_PER_SECOND) - sampleIntervalMs;
+        tick += tickRate / STATES_PER_SECOND;
+        for (const player of players) {
+          const bytes = 180 + player.trackedEntities * 96 + Math.floor(random() * 40);
+          if (state % 2 === 0)
+            record({ kind: "packet", direction: "in", type: "command", peer: player.id, bytes: 58, sequenceId: player.lastProcessedSequenceId, info: { command: "cl_move" } }, offset);
+          record({ kind: "packet", direction: "out", type: "sv_state", peer: player.id, bytes, tick, info: { entities: player.trackedEntities, ack: player.lastProcessedSequenceId } }, offset + 2);
+          lastStates.set(player.id, { tick, bytes, entities: player.trackedEntities });
+        }
+      }
+      for (const player of players) {
+        record({ kind: "packet", direction: "in", type: "ping", peer: player.id, bytes: 0 });
+        record({ kind: "packet", direction: "out", type: "pong", peer: player.id, bytes: 0 });
+      }
+      if (step % 9 === 0)
+        record({ kind: "event", type: "sync_leave", peer: players[0].id, tick, info: { count: 2, entities: ["rock-12", "rock-40"] } });
+      if (step % 13 === 0)
+        record({ kind: "event", type: "dropped", peer: players.at(-1).id, info: { reason: "DROPPED_FROM_BUFFERING", message: "sv_state" } });
+      if (step % 4 === 0)
+        record({ kind: "packet", direction: "out", type: "sv_chat", peer: players[0].id, bytes: 74, reliable: true });
+      syncPlayers = players.map((player) => ({
+        id: player.id,
+        displayName: player.displayName,
+        position: player.position,
+        ack: player.lastProcessedSequenceId,
+        tracked: Array.from({ length: player.trackedEntities }, (_, i) => `entity-${i}`),
+        lastState: lastStates.get(player.id) ?? null
+      }));
       if (step % 10 === 0)
         request("GET", "/api/game/health", 200, 180, "198.51.100.7");
       if (step % 23 === 0)
@@ -671,6 +1021,47 @@ function simulatedSource(seed = 1, sampleIntervalMs = 1e3) {
     },
     async fetchRequests(afterId) {
       return { entries: requests.filter((entry) => entry.id > afterId), latestId: requests.length };
+    },
+    async fetchPackets(afterId) {
+      const records = packets.filter((entry) => entry.id > afterId);
+      return { enabled: true, latestId: packetId, matched: records.length, records };
+    },
+    async fetchPacket(id) {
+      const found = packets.find((entry) => entry.id === id);
+      if (!found)
+        return { record: null };
+      if (found.kind === "event" || !found.bytes)
+        return { record: found };
+      const info = found.info ?? {};
+      const payload = found.type === "sv_state" ? {
+        type: "sv_state",
+        sequenceId: 0,
+        tick: found.tick,
+        serverTime: found.timestamp,
+        ack: info.ack,
+        entities: Array.from({ length: info.entities ?? 0 }, (_, i) => ({
+          id: i === 0 ? found.peer : `entity-${i}`,
+          $typeName: i === 0 ? "player" : "rock",
+          position: { x: i * 3, y: 0, z: -i * 2 },
+          rotation: { x: 0, y: i % 6 / 2, z: 0 },
+          scale: { x: 1, y: 1, z: 1 }
+        }))
+      } : found.type === "command" ? { type: "cl_move", sequenceId: found.sequenceId, keys: ["KeyW"], yaw: 1.57 } : found.type === "cl_init" ? { name: `Player ${String(found.peer).slice(-2)}` } : { playerId: found.peer, playerName: "Player 1", message: "hello" };
+      return { record: { ...found, payload } };
+    },
+    async fetchSync() {
+      const entities = [
+        ...syncPlayers.map((player) => ({ id: player.id, type: "player", player: true, trackedBy: syncPlayers.length })),
+        // The last few are out of every player's range
+        ...Array.from({ length: 140 }, (_, i) => ({ id: `entity-${i}`, type: "rock", player: false, trackedBy: i < 134 ? 1 + i % syncPlayers.length : 0 }))
+      ];
+      return { tick, serverTime: now, tickRate, syncDistance: 200, players: syncPlayers, editors: [], entities };
+    },
+    async fetchRoutes() {
+      return { routes: SIMULATED_ROUTES };
+    },
+    async fetchPlugins() {
+      return { plugins: SIMULATED_PLUGINS };
     }
   };
 }
@@ -834,7 +1225,14 @@ var LOGO_SIZES = [
 ];
 
 // src/dashboard/view.ts
-var DASHBOARD_TABS = ["Overview", "Players", "Logs", "HTTP"];
+function initialViewState() {
+  return { tab: 0, playerOffset: 0, logFromEnd: 0, requestTopId: null, selectedPlayerId: null, followSelectedPlayer: true, packetTopId: null, showPings: false, eventsOnly: false, selectedPacketId: null, followSelectedPacket: true, payloadOffset: 0 };
+}
+var DASHBOARD_TABS = ["Overview", "Players", "Logs", "HTTP", "Network", "Routes", "Plugins"];
+function showsNetwork(view) {
+  return DASHBOARD_TABS[view.tab] === "Network";
+}
+var MESSAGE_STATS_WINDOW_MS = 5e3;
 var WIDE_LAYOUT = 100;
 var NEWLINE_RE = /\r?\n/;
 var STATUS_LABELS = {
@@ -870,6 +1268,123 @@ function handlePlayersKey(view, snapshot, key) {
   view.followSelectedPlayer = true;
   return true;
 }
+function selectPacket(view, id) {
+  view.selectedPacketId = id;
+  view.payloadOffset = 0;
+  view.followSelectedPacket = true;
+}
+function handleNetworkKey(view, key, packets = []) {
+  if (!showsNetwork(view))
+    return false;
+  if (key === "escape") {
+    const had = view.selectedPacketId !== null;
+    selectPacket(view, null);
+    return had;
+  }
+  const delta = key === "down" || key === "j" ? 1 : key === "up" || key === "k" ? -1 : 0;
+  if (delta !== 0) {
+    const rows = visiblePackets(packets, view).reverse();
+    if (rows.length === 0)
+      return false;
+    const current = rows.findIndex((p) => p.id === view.selectedPacketId);
+    const next = current === -1 ? delta > 0 ? 0 : rows.length - 1 : Math.max(0, Math.min(rows.length - 1, current + delta));
+    selectPacket(view, rows[next].id);
+    return true;
+  }
+  if (key === "p")
+    view.showPings = !view.showPings;
+  else if (key === "e")
+    view.eventsOnly = !view.eventsOnly;
+  else
+    return false;
+  view.packetTopId = null;
+  return true;
+}
+function messageStats(packets, windowMs = MESSAGE_STATS_WINDOW_MS) {
+  const newest = packets.at(-1)?.timestamp;
+  if (newest === void 0)
+    return [];
+  const recent = packets.filter((p) => p.kind === "packet" && p.direction && p.timestamp > newest - windowMs);
+  const seconds = Math.max(1e3, Math.min(windowMs, newest - (packets[0]?.timestamp ?? newest))) / 1e3;
+  const groups = /* @__PURE__ */ new Map();
+  for (const packet of recent) {
+    const key = `${packet.direction} ${packet.type}`;
+    const group = groups.get(key) ?? { direction: packet.direction, type: packet.type, count: 0, bytes: 0 };
+    group.count++;
+    group.bytes += packet.bytes;
+    groups.set(key, group);
+  }
+  return Array.from(groups.values(), ({ direction, type, count, bytes }) => ({ direction, type, rate: count / seconds, bytesPerSecond: bytes / seconds, avgBytes: bytes / count })).sort((a, b) => b.bytesPerSecond - a.bytesPerSecond || b.rate - a.rate || a.type.localeCompare(b.type));
+}
+function describePacket(packet) {
+  const parts = [];
+  if (packet.tick !== null)
+    parts.push(`tick ${packet.tick}`);
+  if (packet.sequenceId !== null)
+    parts.push(`seq ${packet.sequenceId}`);
+  if (packet.reliable)
+    parts.push("reliable");
+  for (const [key, value] of Object.entries(packet.info)) {
+    if (value === void 0 || value === null)
+      continue;
+    parts.push(`${key} ${Array.isArray(value) ? value.join(", ") : typeof value === "object" ? JSON.stringify(value) : String(value)}`);
+  }
+  return parts.join(" \xB7 ");
+}
+function installable(plugins, available) {
+  return available ? notInProject(available.state.plugins, plugins.map((p) => p.package)) : [];
+}
+function selectedPlugin(view, plugins, rest = []) {
+  const installed = plugins.find((p) => p.package === view.selectedPlugin);
+  if (installed)
+    return { installed };
+  const available = rest.find((p) => p.package === view.selectedPlugin);
+  if (available)
+    return { available };
+  return plugins.length ? { installed: plugins[0] } : { available: rest[0] };
+}
+function handlePluginsKey(view, plugins, key, rest = []) {
+  if (DASHBOARD_TABS[view.tab] !== "Plugins" || view.confirmInstall)
+    return false;
+  const delta = key === "down" || key === "j" ? 1 : key === "up" || key === "k" ? -1 : 0;
+  const packages = [...plugins, ...rest].map((p) => p.package);
+  if (delta === 0 || packages.length === 0)
+    return false;
+  const shown = selectedPlugin(view, plugins, rest);
+  const current = Math.max(0, packages.indexOf((shown.installed ?? shown.available).package));
+  view.selectedPlugin = packages[Math.max(0, Math.min(packages.length - 1, current + delta))];
+  return true;
+}
+function handleInstallKey(view, plugins, key, rest, installer) {
+  if (DASHBOARD_TABS[view.tab] !== "Plugins" || !installer)
+    return false;
+  if (view.confirmInstall) {
+    const pkg = view.confirmInstall;
+    if (key === "y") {
+      view.confirmInstall = null;
+      return installer.busy ? true : pkg;
+    }
+    if (key === "n" || key === "escape") {
+      view.confirmInstall = null;
+      return true;
+    }
+    return false;
+  }
+  const { available } = selectedPlugin(view, plugins, rest);
+  if (key !== "i" || !available || installer.busy)
+    return false;
+  view.confirmInstall = available.package;
+  return true;
+}
+function pluginKeys(state, view, available, installer) {
+  if (view.confirmInstall)
+    return [{ key: "y", label: "Install" }, { key: "n", label: "Cancel" }];
+  const rest = installable(state.plugins, available);
+  return [
+    ...state.plugins.length + rest.length > 1 ? [{ key: "\u2191\u2193", label: "Select plugin" }] : [],
+    ...installer && !installer.busy && selectedPlugin(view, state.plugins, rest).available ? [{ key: "i", label: "Install" }] : []
+  ];
+}
 function statusColor(status, theme) {
   if (status === "live")
     return theme.success;
@@ -877,7 +1392,7 @@ function statusColor(status, theme) {
     return theme.warning;
   return theme.danger;
 }
-function renderDashboard(ui, theme, state, view, { transparent = false, startup, openKey = false } = {}) {
+function renderDashboard(ui, theme, state, view, { transparent = false, startup, openKey = false, available, installer } = {}) {
   const { snapshot } = state;
   const starting = !snapshot && !!startup && (state.status === "connecting" || state.status === "unreachable");
   ui.column({}, (root) => {
@@ -907,6 +1422,12 @@ function renderDashboard(ui, theme, state, view, { transparent = false, startup,
         logsPanel(root, theme, state, view);
       } else if (tab === "HTTP") {
         requestsPanel(root, theme, state, view, transparent);
+      } else if (tab === "Network") {
+        networkTab(root, theme, state, view, transparent);
+      } else if (tab === "Routes") {
+        routesPanel(root, theme, state, view, transparent);
+      } else if (tab === "Plugins") {
+        pluginsTab(root, theme, state, view, transparent, available, installer);
       } else {
         root.responsive({
           [WIDE_LAYOUT]: (c) => wideLayout(c, theme, state, snapshot, view, transparent),
@@ -922,7 +1443,14 @@ function renderDashboard(ui, theme, state, view, { transparent = false, startup,
         { key: "r", label: "Refresh" },
         { key: `1-${DASHBOARD_TABS.length}`, label: "Tabs" },
         ...openKey && snapshot ? [{ key: "o", label: "Open game" }] : [],
-        ...snapshot && DASHBOARD_TABS[view.tab] === "Players" ? [{ key: "\u2191\u2193", label: "Select player" }, ...view.selectedPlayerId ? [{ key: "esc", label: "Close" }] : []] : []
+        ...snapshot && DASHBOARD_TABS[view.tab] === "Players" ? [{ key: "\u2191\u2193", label: "Select player" }, ...view.selectedPlayerId ? [{ key: "esc", label: "Close" }] : []] : [],
+        ...snapshot && showsNetwork(view) ? [
+          { key: "p", label: view.showPings ? "Hide pings" : "Show pings" },
+          { key: "e", label: view.eventsOnly ? "All records" : "Events only" },
+          { key: "\u2191\u2193", label: "Open packet" },
+          ...view.selectedPacketId !== null ? [{ key: "esc", label: "Close" }] : []
+        ] : [],
+        ...snapshot && DASHBOARD_TABS[view.tab] === "Plugins" ? pluginKeys(state, view, available, installer) : []
       ],
       right: [starting ? { label: "STARTING", color: statusColor("connecting", theme) } : { label: STATUS_LABELS[state.status], color: statusColor(state.status, theme), active: state.status === "live" }]
     });
@@ -1299,129 +1827,1121 @@ function requestsPanel(ui, theme, state, view, transparent) {
     });
   });
 }
-
-// src/commands/dashboard.ts
-var DASHBOARD_HELP = `Usage: mavonengine dashboard [options]
-
-Live terminal dashboard for a running MavonEngine game server.
-
-Options:
-  --host <host>        Server host (default: localhost)
-  --port <port>        Server HTTP port (default: 8050)
-  --url <url>          Full metrics URL, overrides --host and --port
-  --token <token>      Metrics token (or set MAVONENGINE_METRICS_TOKEN)
-  --interval <ms>      Poll interval in ms (default: 1000)
-  --theme <name>       dark, dracula, nord, tokyoNight, gruvbox, matrix, light, \u2026
-  --transparent        Let a transparent terminal background show through
-                       (text can be hard to read over a light wallpaper)
-  --sim                Show simulated data instead of connecting to a server
-  -h, --help           Show this help
-`;
-var STARTUP_POLL_MS = 250;
-var UsageError = class extends Error {
-};
-function parseDashboardArgs(args, env = process2.env) {
-  const { values } = parseArgs({
-    args,
-    options: {
-      host: { type: "string", default: "localhost" },
-      port: { type: "string", default: "8050" },
-      url: { type: "string" },
-      token: { type: "string" },
-      interval: { type: "string", default: "1000" },
-      theme: { type: "string" },
-      transparent: { type: "boolean", default: false },
-      sim: { type: "boolean", default: false },
-      help: { type: "boolean", short: "h", default: false }
-    },
-    strict: true,
-    allowPositionals: false
-  });
-  if (values.help)
-    return "help";
-  const intervalMs = Number(values.interval);
-  if (!Number.isInteger(intervalMs) || intervalMs < 100)
-    throw new UsageError("--interval must be a whole number of ms, at least 100");
-  if (values.sim)
-    return { source: simulatedSource(), intervalMs, theme: values.theme, transparent: values.transparent };
-  let url = values.url;
-  if (!url) {
-    const port = Number(values.port);
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
-      throw new UsageError("--port must be between 1 and 65535");
-    const host = values.host.includes(":") && !values.host.startsWith("[") ? `[${values.host}]` : values.host;
-    url = `http://${host}:${port}/api/game/metrics`;
-  }
-  try {
-    void new URL(url);
-  } catch {
-    throw new UsageError(`Invalid --url: ${url}`);
+var NETWORK_UNAVAILABLE = "Not available: the game server runs with NODE_ENV=production, where nothing is recorded, or it runs a @mavonengine/core release without GET /api/game/dev/net";
+var NARROW_PACKET_DETAILS_SIZE = 12;
+var NETWORK_SUMMARY_SIZE = 10;
+function networkTab(ui, theme, state, view, transparent) {
+  if (state.packetsAvailable === false) {
+    ui.panel({ title: "Network", size: "1fr" }, (panel) => panel.text(NETWORK_UNAVAILABLE, { wrap: true }));
+    return;
   }
-  const token = values.token ?? env.MAVONENGINE_METRICS_TOKEN;
-  return { source: httpSource({ url, token }), clientUrl: new URL("/", url).href, intervalMs, theme: values.theme, transparent: values.transparent };
-}
-async function runDashboard(options, signal) {
-  const { createApp } = await import("@profullstack/hqtui");
-  const client = new MetricsClient(options.source, {
-    intervalMs: options.intervalMs,
-    startupIntervalMs: options.startup ? STARTUP_POLL_MS : void 0
+  ui.responsive({
+    [WIDE_LAYOUT]: (c) => c.row({ size: NETWORK_SUMMARY_SIZE }, (row) => {
+      syncPanel(row, theme, state, transparent);
+      messagesPanel(row, theme, state, transparent);
+    }),
+    0: (c) => {
+      syncPanel(c, theme, state, transparent, NETWORK_SUMMARY_SIZE);
+      messagesPanel(c, theme, state, transparent, NETWORK_SUMMARY_SIZE);
+    }
   });
-  const view = { tab: 0, playerOffset: 0, logFromEnd: 0, requestTopId: null, selectedPlayerId: null, followSelectedPlayer: true };
-  const app = await createApp({ fps: 15, theme: readableTheme(options.theme), paintBackground: !options.transparent });
-  app.render(({ ui, theme }) => renderDashboard(ui, theme, client.state, view, {
-    transparent: options.transparent,
-    startup: options.startup?.(),
-    openKey: !!options.clientUrl
-  }));
-  client.onChange(() => app.invalidate());
-  const { clientUrl } = options;
-  if (clientUrl && options.openBrowser) {
-    const off = client.onChange(async (state) => {
-      if (state.status !== "live")
-        return;
-      off();
-      if (await servesPage(clientUrl))
-        openBrowser(clientUrl);
-    });
+  if (view.selectedPacketId === null) {
+    packetsPanel(ui, theme, state, view, transparent);
+    return;
   }
-  app.on("key", (event) => {
-    if (event.key === "r")
-      void client.refresh();
-    if (event.key === "o" && options.clientUrl)
-      openBrowser(options.clientUrl);
-    const tab = tabForKey(event.key);
-    if (tab !== null) {
-      view.tab = tab;
-      app.invalidate();
+  ui.responsive({
+    [WIDE_LAYOUT]: (c) => c.row({ size: "1fr" }, (row) => {
+      packetsPanel(row, theme, state, view, transparent);
+      packetDetails(row, theme, state, view, "40%");
+    }),
+    0: (c) => {
+      packetsPanel(c, theme, state, view, transparent);
+      packetDetails(c, theme, state, view, NARROW_PACKET_DETAILS_SIZE);
     }
-    if (handlePlayersKey(view, client.state.snapshot, event.key))
-      app.invalidate();
   });
-  app.on("exit", () => client.stop());
-  const onAbort = () => app.stop();
-  signal?.addEventListener("abort", onAbort);
-  client.start();
-  if (!signal?.aborted)
-    await app.start();
-  signal?.removeEventListener("abort", onAbort);
-  client.stop();
 }
-
-// src/commands/dev.ts
-import { execFileSync, spawn as spawn2 } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { constants } from "os";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
-import process3 from "process";
-import { setTimeout as delay } from "timers/promises";
-import { parseArgs as parseArgs2 } from "util";
-var DEV_HELP = `Usage: mavonengine dev [options]
-
-Run the dev servers of the MavonEngine project you are in (game server and client)
-and show the dashboard for it. Once the game server is up, the game opens in the
-browser. Quitting the dashboard stops the dev servers.
-
-Runs the project's 'dev:server' script, or its 'dev' script when there is none.
+function packetDetails(ui, theme, state, view, size) {
+  const id = view.selectedPacketId;
+  const packet = state.packets.find((p) => p.id === id);
+  const detail = state.packetDetail?.id === id ? state.packetDetail : null;
+  const name = packet ? `${packet.type}${packet.direction ? ` ${packet.direction}` : ""}` : `#${id}`;
+  const title = packet?.kind === "packet" ? `${name} \xB7 ${formatBytes(packet.bytes)}` : name;
+  ui.panel({ title, size }, (panel) => {
+    if (packet) {
+      const facts = describePacket({ ...packet, info: {} });
+      panel.text([
+        { text: formatTimeMs(packet.timestamp), fg: theme.muted },
+        ...packet.peer ? [{ text: `  ${packet.peer}` }] : [],
+        ...facts ? [{ text: `  ${facts}`, fg: theme.muted }] : []
+      ], { size: 1 });
+    }
+    if (!detail || detail.status === "loading") {
+      panel.label("Loading\u2026");
+      return;
+    }
+    if (detail.status === "error") {
+      panel.text([{ text: detail.error ?? "Could not load it", fg: theme.danger }], { wrap: true });
+      return;
+    }
+    if (detail.status === "gone") {
+      panel.text("The server no longer keeps this payload: it keeps the last 2000 records and 8 MB of payloads.", { wrap: true });
+      return;
+    }
+    if (detail.status === "empty") {
+      panel.label("No payload");
+      return;
+    }
+    const maxOffset = Math.max(0, detail.lines.length - 1);
+    view.payloadOffset = Math.min(view.payloadOffset, maxOffset);
+    panel.list({
+      items: detail.lines,
+      offset: view.payloadOffset,
+      bullet: "",
+      scrollbar: true,
+      size: "1fr",
+      onScroll: (delta) => {
+        view.payloadOffset = Math.max(0, Math.min(maxOffset, view.payloadOffset + delta * 3));
+        ui.ctx.invalidate();
+      }
+    });
+  });
+}
+function syncPanel(ui, theme, { sync }, transparent, size = "1fr") {
+  ui.panel({ title: sync ? `State sync (tick ${sync.tick})` : "State sync", size }, (panel) => {
+    if (!sync) {
+      panel.label("Waiting for the server\u2026");
+      return;
+    }
+    panel.text([
+      { text: `${sync.entities}`, bold: true },
+      { text: sync.entities === 1 ? " synced entity" : " synced entities", fg: theme.muted },
+      ...sync.untracked > 0 ? [{ text: `, ${sync.untracked} out of every player's range`, fg: theme.warning }] : [],
+      { text: "  distance ", fg: theme.muted },
+      { text: sync.syncDistance === null ? "unknown" : String(sync.syncDistance) },
+      ...sync.editors > 0 ? [{ text: `  ${sync.editors} editor${sync.editors === 1 ? "" : "s"}`, fg: theme.info }] : []
+    ], { size: 1 });
+    if (sync.players.length === 0) {
+      panel.label("No players connected");
+      return;
+    }
+    const newest = Math.max(...sync.players.map((p) => p.lastState?.tick ?? 0));
+    panel.table({
+      rows: [...sync.players].sort((a, b) => a.id.localeCompare(b.id)),
+      scrollbar: true,
+      zebra: !transparent,
+      size: "1fr",
+      columns: [
+        { key: "displayName", title: "Player" },
+        { key: "tracked", title: "Tracked", width: 8, align: "right" },
+        { key: "ack", title: "Ack", width: 9, align: "right" },
+        { key: "bytes", title: "State", width: 10, align: "right", render: (p) => p.lastState ? formatBytes(p.lastState.bytes) : "\u2014" },
+        {
+          key: "tick",
+          title: "Tick",
+          width: 9,
+          align: "right",
+          color: (p) => !p.lastState || newest - p.lastState.tick > sync.tickRate ? theme.danger : void 0,
+          render: (p) => p.lastState ? String(p.lastState.tick) : "none"
+        }
+      ]
+    });
+  });
+}
+function messagesPanel(ui, theme, state, transparent, size = "1fr") {
+  const stats = messageStats(state.packets);
+  ui.panel({ title: `By message (last ${MESSAGE_STATS_WINDOW_MS / 1e3} s)`, size }, (panel) => {
+    if (stats.length === 0) {
+      panel.label(state.packetsAvailable === null ? "Waiting for the server\u2026" : "No packets yet");
+      return;
+    }
+    panel.table({
+      rows: stats,
+      scrollbar: true,
+      zebra: !transparent,
+      size: "1fr",
+      columns: [
+        { key: "direction", title: "", width: 3, color: (s) => s.direction === "out" ? theme.graph[0] : theme.graph[1], render: (s) => s.direction === "out" ? "out" : "in" },
+        { key: "type", title: "Message" },
+        { key: "rate", title: "Per s", width: 8, align: "right", render: (s) => s.rate.toFixed(1) },
+        { key: "avgBytes", title: "Avg size", width: 10, align: "right", render: (s) => formatBytes(Math.round(s.avgBytes)) },
+        { key: "bytesPerSecond", title: "Rate", width: 12, align: "right", render: (s) => formatRate(Math.round(s.bytesPerSecond)) }
+      ]
+    });
+  });
+}
+function formatTimeMs(timestamp) {
+  return `${formatTime(timestamp)}.${(timestamp % 1e3).toString().padStart(3, "0")}`;
+}
+function visiblePackets(packets, view) {
+  return packets.filter((p) => (!view.eventsOnly || p.kind === "event") && (view.showPings || p.type !== "ping" && p.type !== "pong"));
+}
+function packetsPanel(ui, theme, state, view, transparent) {
+  const rows = visiblePackets(state.packets, view).reverse();
+  const anchor = view.packetTopId === null ? 0 : rows.findIndex((r) => r.id <= view.packetTopId);
+  const offset = Math.max(0, anchor);
+  const what = view.eventsOnly ? "Events" : "Packets and events";
+  const title = `${what} (${rows.length}${view.showPings || view.eventsOnly ? "" : ", pings hidden"})${offset > 0 ? ", scroll up to follow" : ""}`;
+  ui.panel({ title, size: "1fr" }, (panel) => {
+    if (rows.length === 0) {
+      panel.label(state.packetsAvailable === null ? "Waiting for the server\u2026" : view.eventsOnly ? "No events yet" : "No packets yet");
+      return;
+    }
+    let top = offset;
+    const narrow = panel.width < WIDE_LAYOUT;
+    const directionColor = (p) => p.kind === "event" ? theme.warning : p.direction === "out" ? theme.graph[0] : theme.graph[1];
+    panel.table({
+      rows,
+      offset,
+      scrollbar: true,
+      zebra: !transparent,
+      size: "1fr",
+      selected: rows.findIndex((p) => p.id === view.selectedPacketId),
+      followSelection: view.selectedPacketId !== null && view.followSelectedPacket,
+      // Following the selection can move the window, so the anchor goes by the row that was really drawn first
+      onRow: (_row, index, y) => {
+        if (y === 1) {
+          top = index;
+          view.packetTopId = index === 0 ? null : rows[index].id;
+        }
+      },
+      // A click opens the packet, a second one on it closes it again
+      onSelectRow: (visibleRow) => {
+        const row = rows[top + visibleRow];
+        if (!row)
+          return;
+        selectPacket(view, row.id === view.selectedPacketId ? null : row.id);
+        ui.ctx.invalidate();
+      },
+      onScroll: (delta) => {
+        const next = Math.max(0, Math.min(rows.length - 1, top + delta));
+        view.packetTopId = next === 0 ? null : rows[next].id;
+        view.followSelectedPacket = false;
+        ui.ctx.invalidate();
+      },
+      columns: [
+        { key: "time", title: "Time", width: 12, color: theme.muted, render: (p) => formatTimeMs(p.timestamp) },
+        { key: "direction", title: "", width: 3, color: directionColor, render: (p) => p.kind === "event" ? "\u2022" : p.direction === "out" ? "out" : "in" },
+        { key: "type", title: "Message", width: narrow ? 12 : 18, color: (p) => p.kind === "event" ? theme.warning : void 0 },
+        { key: "peer", title: "Client", width: narrow ? 8 : 26, color: theme.muted, render: (p) => p.peer ?? "\u2014" },
+        { key: "bytes", title: "Size", width: narrow ? 9 : 10, align: "right", render: (p) => p.kind === "packet" ? formatBytes(p.bytes) : "" },
+        { key: "info", title: "Details", render: describePacket }
+      ]
+    });
+  });
+}
+function methodColor(method, theme) {
+  if (method === "GET")
+    return theme.success;
+  if (method === "DELETE")
+    return theme.danger;
+  if (method === "ALL")
+    return theme.muted;
+  return theme.warning;
+}
+function routeSource(route) {
+  return route.source === "plugin" ? route.plugin ?? "plugin" : route.source;
+}
+function routeEnvironment(route) {
+  return route.devOnly ? "dev only" : "prod + dev";
+}
+function routesPanel(ui, theme, state, view, transparent) {
+  const rows = state.routes;
+  const maxOffset = Math.max(0, rows.length - 1);
+  const offset = Math.min(view.routeOffset ?? 0, maxOffset);
+  view.routeOffset = offset;
+  const fromPlugins = rows.filter((r) => r.source === "plugin");
+  const plugins = new Set(fromPlugins.map(routeSource)).size;
+  const devOnly = rows.filter((r) => r.devOnly).length;
+  const counts = [
+    `${rows.filter((r) => r.source === "engine").length} engine`,
+    `${rows.filter((r) => r.source === "game").length} game`,
+    `${fromPlugins.length} from ${plugins} plugin${plugins === 1 ? "" : "s"}`,
+    `${devOnly} dev only`
+  ];
+  ui.panel({ title: `HTTP endpoints (${rows.length}: ${counts.join(", ")})`, size: "1fr" }, (panel) => {
+    if (state.routesAvailable === false) {
+      panel.label("Not available: the server runs a @mavonengine/core release without GET /api/game/routes");
+      return;
+    }
+    if (rows.length === 0) {
+      panel.label(state.routesAvailable === null ? "Asking the server for its endpoints\u2026" : "The server has no endpoints");
+      return;
+    }
+    panel.table({
+      rows,
+      offset,
+      scrollbar: true,
+      // Zebra stripes are solid fills, which would break transparency
+      zebra: !transparent,
+      size: "1fr",
+      // The table won't scroll past the last full page, so keep our offset on the row it actually drew
+      onRow: (_row, index, y) => {
+        if (y === 1)
+          view.routeOffset = index;
+      },
+      onScroll: (delta) => {
+        view.routeOffset = Math.max(0, Math.min(maxOffset, offset + delta));
+        ui.ctx.invalidate();
+      },
+      columns: [
+        { key: "method", title: "Method", width: 7, color: (r) => methodColor(r.method, theme) },
+        { key: "path", title: "Path" },
+        { key: "devOnly", title: "Served in", width: 10, color: (r) => r.devOnly ? theme.warning : theme.success, render: routeEnvironment },
+        { key: "source", title: "From", width: 30, color: (r) => r.source === "engine" ? theme.muted : r.source === "plugin" ? theme.primary : void 0, render: routeSource },
+        { key: "summary", title: "What it does", color: theme.muted, render: (r) => r.summary ?? "" }
+      ]
+    });
+  });
+}
+var PLUGIN_TARGETS = { client: "client", server: "server", both: "client + server" };
+function pluginStatus(plugin, theme) {
+  if (plugin.problem)
+    return { label: "problem", color: theme.danger };
+  if (!plugin.enabled)
+    return { label: "disabled", color: theme.muted };
+  if ((plugin.target === "server" || plugin.target === "both") && !plugin.runningOnServer)
+    return { label: "not loaded", color: theme.warning };
+  return { label: "enabled", color: theme.success };
+}
+function pluginsTab(ui, theme, state, view, transparent, available, installer) {
+  const { plugins } = state;
+  void available?.load();
+  const rest = installable(plugins, available);
+  const shown = selectedPlugin(view, plugins, rest);
+  const endpoints = (plugin) => state.routes.filter((r) => r.source === "plugin" && r.plugin === plugin.package);
+  const confirm = rest.find((p) => p.package === view.confirmInstall);
+  if (!confirm)
+    view.confirmInstall = null;
+  if (state.pluginsAvailable === false || plugins.length === 0) {
+    ui.panel({ title: "Plugins", size: available ? 3 : "1fr" }, (panel) => {
+      if (state.pluginsAvailable === false)
+        panel.label("Not available: the server runs a @mavonengine/core release without GET /api/game/plugins");
+      else
+        panel.label(state.pluginsAvailable === null ? "Asking the server for its plugins\u2026" : "The project has no plugins. Add one with: mavonengine install <package>");
+    });
+  } else {
+    let top = 0;
+    ui.panel({ title: `Plugins (${plugins.length})`, size: Math.min(plugins.length, 8) + 3 }, (panel) => {
+      panel.table({
+        rows: plugins,
+        selected: shown.installed ? plugins.indexOf(shown.installed) : -1,
+        followSelection: true,
+        // With more plugins than rows the table scrolls to the selection, so a click counts from the row drawn first
+        onRow: (_row, index, y) => {
+          if (y === 1)
+            top = index;
+        },
+        onSelectRow: (visibleRow) => {
+          const row = plugins[top + visibleRow];
+          if (!row || view.confirmInstall)
+            return;
+          view.selectedPlugin = row.package;
+          ui.ctx.invalidate();
+        },
+        scrollbar: true,
+        // Zebra stripes are solid fills, which would break transparency
+        zebra: !transparent,
+        size: "1fr",
+        columns: [
+          { key: "package", title: "Package" },
+          { key: "version", title: "Version", width: 8, render: (p) => p.version ?? "\u2014" },
+          { key: "status", title: "Status", width: 10, color: (p) => pluginStatus(p, theme).color, render: (p) => pluginStatus(p, theme).label },
+          { key: "target", title: "Runs on", width: 7, render: (p) => p.target ?? "\u2014" },
+          { key: "endpoints", title: "Routes", width: 6, align: "right", render: (p) => state.routesAvailable ? String(endpoints(p).length) : "\u2014" },
+          { key: "prefabs", title: "Prefabs", width: 7, align: "right", render: (p) => String((/* @__PURE__ */ new Set([...p.declaredPrefabs, ...p.usedPrefabs])).size) }
+        ]
+      });
+    });
+  }
+  if (installer?.job)
+    installPanel(ui, theme, installer.job);
+  if (confirm)
+    confirmInstallPanel(ui, theme, confirm);
+  else if (shown.installed)
+    pluginDetails(ui, theme, state, shown.installed, endpoints(shown.installed), "1fr", transparent);
+  else if (shown.available)
+    availableDetails(ui, theme, shown.available, installer);
+  if (available)
+    availablePanel(ui, theme, available, rest, shown.available, view, shown.installed || confirm || shown.available ? Math.min(Math.max(1, rest.length), 6) + 3 : "1fr", transparent);
+}
+var INSTALL_OUTPUT_LINES = 6;
+var INSTALL_STATUS = {
+  installing: "Installing",
+  restarting: "Installed, restarting the dev servers for",
+  done: "Installed",
+  failed: "Could not install"
+};
+function installPanel(ui, theme, job) {
+  const lines = stripVTControlCharacters(job.output).split(NEWLINE_RE).filter((line) => line.trim() !== "");
+  const color = job.status === "failed" ? theme.danger : job.status === "done" ? theme.success : theme.warning;
+  ui.panel({ title: `${INSTALL_STATUS[job.status]} ${job.packages.join(", ")}`, size: INSTALL_OUTPUT_LINES + 3 }, (panel) => {
+    if (job.status === "failed")
+      panel.text([{ text: job.error ?? "The install failed", fg: color }], { size: 1 });
+    else if (job.status === "done")
+      panel.text([{ text: "The dev servers were restarted with it", fg: color }], { size: 1 });
+    else
+      panel.spinner({ label: job.status === "restarting" ? "Stopping and starting the dev script" : "Running the package manager", size: 1 });
+    panel.log({ entries: lines.slice(-INSTALL_OUTPUT_LINES).map((message) => ({ message })), size: "1fr" });
+  });
+}
+function confirmInstallPanel(ui, theme, plugin) {
+  ui.panel({ title: `Install ${plugin.package}?`, size: "1fr" }, (panel) => {
+    panel.text([{ text: "Installing a package runs its code on this machine.", fg: theme.warning, bold: true }], { wrap: true });
+    panel.text("Its install scripts run right away, and the plugin runs inside your game and game server from then on, with everything they can reach. The list of plugins is not a review of what is on it.", { wrap: true });
+    panel.spacer(1);
+    panel.text("Check the source before you install it:", { wrap: true });
+    panel.text([{ text: `  ${plugin.homepage ?? `https://www.npmjs.com/package/${plugin.package}`}`, fg: theme.primary }], { wrap: true });
+    panel.spacer(1);
+    panel.text(`It is installed with the project's package manager, added to mavonengine.json, and the dev servers are restarted.`, { wrap: true });
+    panel.spacer(1);
+    panel.text([
+      { text: " y ", fg: theme.background, bg: theme.warning, bold: true },
+      { text: " I checked the source, install it    " },
+      { text: " n ", fg: theme.background, bg: theme.muted, bold: true },
+      { text: " Cancel" }
+    ], { size: 1 });
+  });
+}
+function availableDetails(ui, theme, plugin, installer) {
+  ui.panel({ title: plugin.name === plugin.package ? plugin.package : `${plugin.name} (${plugin.package})`, size: "1fr" }, (panel) => {
+    if (plugin.description)
+      panel.text(plugin.description, { wrap: true });
+    panel.keyValues([
+      { label: "Status", value: "not installed", color: theme.muted },
+      { label: "Runs on", value: plugin.target ? PLUGIN_TARGETS[plugin.target] : "\u2014" },
+      { label: "Engine", value: plugin.engine ? `@mavonengine/core ${plugin.engine}` : "\u2014" },
+      { label: "Source", value: plugin.homepage ?? `https://www.npmjs.com/package/${plugin.package}`, color: theme.primary }
+    ], { spread: true });
+    panel.spacer(1);
+    if (!installer)
+      panel.label(`Install it with: mavonengine install ${plugin.package}`);
+    else if (installer.busy)
+      panel.label("Another install is running");
+    else
+      panel.text([{ text: "Press " }, { text: "i", fg: theme.primary, bold: true }, { text: " to install it and restart the dev servers" }], { size: 1 });
+  });
+}
+function availablePanel(ui, theme, available, rows, selected, view, size, transparent) {
+  const { status, error, plugins } = available.state;
+  const loaded = status === "ready" || plugins.length > 0;
+  let top = 0;
+  ui.panel({ title: loaded ? `Available to install (${rows.length})` : "Available to install", size }, (panel) => {
+    if (error) {
+      panel.text([{ text: `Could not read the list of plugins: ${error}`, fg: theme.danger }], { wrap: true });
+      return;
+    }
+    if (!loaded) {
+      panel.spinner({ label: "Reading the list of plugins from GitHub" });
+      return;
+    }
+    if (rows.length === 0) {
+      panel.label(plugins.length ? "The project has every plugin on the list" : "The list of plugins is empty");
+      return;
+    }
+    panel.table({
+      rows,
+      selected: selected ? rows.indexOf(selected) : -1,
+      followSelection: true,
+      onRow: (_row, index, y) => {
+        if (y === 1)
+          top = index;
+      },
+      onSelectRow: (visibleRow) => {
+        const row = rows[top + visibleRow];
+        if (!row || view.confirmInstall)
+          return;
+        view.selectedPlugin = row.package;
+        ui.ctx.invalidate();
+      },
+      scrollbar: true,
+      zebra: !transparent,
+      size: "1fr",
+      columns: [
+        { key: "package", title: "Package", color: theme.primary },
+        { key: "target", title: "Runs on", width: 7, render: (p) => p.target ?? "\u2014" },
+        { key: "description", title: "What it is", color: theme.muted, render: (p) => p.description ?? (p.name === p.package ? "" : p.name) }
+      ]
+    });
+  });
+}
+function pluginDetails(ui, theme, state, plugin, endpoints, size, transparent) {
+  const status = pluginStatus(plugin, theme);
+  const prefabs = [.../* @__PURE__ */ new Set([...plugin.declaredPrefabs, ...plugin.usedPrefabs])];
+  ui.panel({ title: plugin.package, size }, (panel) => {
+    if (plugin.description)
+      panel.text(plugin.description, { wrap: true });
+    if (plugin.problem)
+      panel.text([{ text: plugin.problem, fg: theme.danger }], { wrap: true });
+    panel.keyValues([
+      { label: "Version", value: plugin.version ?? "\u2014" },
+      { label: "Status", value: status.label, color: status.color },
+      { label: "Runs on", value: plugin.target ? PLUGIN_TARGETS[plugin.target] : "\u2014" },
+      // A client plugin has nothing to run here
+      plugin.target === "client" ? { label: "On this server", value: "nothing to run", color: theme.muted } : { label: "On this server", value: plugin.runningOnServer ? "running" : "not running", color: plugin.runningOnServer ? theme.success : theme.warning },
+      { label: "Engine", value: plugin.engine ? `@mavonengine/core ${plugin.engine}` : "\u2014" },
+      { label: "License", value: plugin.license ?? "\u2014" },
+      // Used ones ship their assets in a release
+      { label: "Prefabs", value: prefabs.length ? prefabs.map((name) => plugin.usedPrefabs.includes(name) ? `${name} (used)` : name).join(", ") : "none" }
+    ], { spread: true });
+    panel.spacer(1);
+    if (state.routesAvailable !== true) {
+      panel.label("HTTP endpoints: unknown, the server doesn't list its endpoints");
+      return;
+    }
+    if (endpoints.length === 0) {
+      panel.label("HTTP endpoints: none");
+      return;
+    }
+    panel.label(`HTTP endpoints (${endpoints.length})`);
+    panel.table({
+      rows: endpoints,
+      scrollbar: true,
+      zebra: !transparent,
+      size: "1fr",
+      columns: [
+        { key: "method", title: "Method", width: 7, color: (r) => methodColor(r.method, theme) },
+        { key: "path", title: "Path" },
+        { key: "devOnly", title: "Served in", width: 10, color: (r) => r.devOnly ? theme.warning : theme.success, render: routeEnvironment }
+      ]
+    });
+  });
+}
+
+// src/commands/dashboard.ts
+var DASHBOARD_HELP = `Usage: mavonengine dashboard [options]
+
+Live terminal dashboard for a running MavonEngine game server.
+
+Options:
+  --host <host>        Server host (default: localhost)
+  --port <port>        Server HTTP port (default: 8050)
+  --url <url>          Full metrics URL, overrides --host and --port
+  --token <token>      Metrics or admin token (or set MAVONENGINE_METRICS_TOKEN
+                       or MAVONENGINE_ADMIN_TOKEN)
+  --interval <ms>      Poll interval in ms (default: 1000)
+  --theme <name>       dark, dracula, nord, tokyoNight, gruvbox, matrix, light, \u2026
+  --transparent        Let a transparent terminal background show through
+                       (text can be hard to read over a light wallpaper)
+  --sim                Show simulated data instead of connecting to a server
+  -h, --help           Show this help
+`;
+var STARTUP_POLL_MS = 250;
+var UsageError = class extends Error {
+};
+function parseDashboardArgs(args, env = process3.env) {
+  const { values } = parseArgs({
+    args,
+    options: {
+      host: { type: "string", default: "localhost" },
+      port: { type: "string", default: "8050" },
+      url: { type: "string" },
+      token: { type: "string" },
+      interval: { type: "string", default: "1000" },
+      theme: { type: "string" },
+      transparent: { type: "boolean", default: false },
+      sim: { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    strict: true,
+    allowPositionals: false
+  });
+  if (values.help)
+    return "help";
+  const intervalMs = Number(values.interval);
+  if (!Number.isInteger(intervalMs) || intervalMs < 100)
+    throw new UsageError("--interval must be a whole number of ms, at least 100");
+  if (values.sim)
+    return { source: simulatedSource(), intervalMs, theme: values.theme, transparent: values.transparent };
+  let url = values.url;
+  if (!url) {
+    const port = Number(values.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+      throw new UsageError("--port must be between 1 and 65535");
+    const host = values.host.includes(":") && !values.host.startsWith("[") ? `[${values.host}]` : values.host;
+    url = `http://${host}:${port}/api/game/metrics`;
+  }
+  try {
+    void new URL(url);
+  } catch {
+    throw new UsageError(`Invalid --url: ${url}`);
+  }
+  const token = values.token ?? env.MAVONENGINE_METRICS_TOKEN ?? env.MAVONENGINE_ADMIN_TOKEN;
+  return { source: httpSource({ url, token }), clientUrl: new URL("/", url).href, intervalMs, theme: values.theme, transparent: values.transparent };
+}
+async function runDashboard(options, signal) {
+  const { createApp } = await import("@profullstack/hqtui");
+  const client = new MetricsClient(options.source, {
+    intervalMs: options.intervalMs,
+    startupIntervalMs: options.startup ? STARTUP_POLL_MS : void 0
+  });
+  const view = initialViewState();
+  const app = await createApp({ fps: 15, theme: readableTheme(options.theme), paintBackground: !options.transparent });
+  const available = new AvailablePlugins();
+  available.onChange(() => app.invalidate());
+  const { installer } = options;
+  installer?.onChange((job) => {
+    app.invalidate();
+    if (job.status === "done")
+      void client.refresh();
+  });
+  const installable2 = () => notInProject(available.state.plugins, client.state.plugins.map((plugin) => plugin.package));
+  app.render(({ ui, theme }) => {
+    renderDashboard(ui, theme, client.state, view, {
+      available,
+      installer,
+      transparent: options.transparent,
+      startup: options.startup?.(),
+      openKey: !!options.clientUrl
+    });
+    const watch = showsNetwork(view);
+    if (watch && !client.watchNetwork) {
+      client.watchNetwork = true;
+      void client.refresh();
+    }
+    client.watchNetwork = watch;
+    if ((client.state.packetDetail?.id ?? null) !== view.selectedPacketId)
+      void client.inspectPacket(view.selectedPacketId);
+  });
+  client.onChange(() => app.invalidate());
+  const { clientUrl } = options;
+  if (clientUrl && options.openBrowser) {
+    const off = client.onChange(async (state) => {
+      if (state.status !== "live")
+        return;
+      off();
+      if (await servesPage(clientUrl))
+        openBrowser(clientUrl);
+    });
+  }
+  app.on("key", (event) => {
+    const install = handleInstallKey(view, client.state.plugins, event.key, installable2(), installer);
+    if (install) {
+      if (typeof install === "string")
+        installer.start([install]);
+      app.invalidate();
+      return;
+    }
+    if (event.key === "r") {
+      void client.refresh();
+      if (available.state.status !== "idle")
+        void available.load(true);
+    }
+    if (event.key === "o" && options.clientUrl)
+      openBrowser(options.clientUrl);
+    const tab = tabForKey(event.key);
+    if (tab !== null) {
+      view.tab = tab;
+      app.invalidate();
+    }
+    if (handlePlayersKey(view, client.state.snapshot, event.key) || handleNetworkKey(view, event.key, client.state.packets) || handlePluginsKey(view, client.state.plugins, event.key, installable2()))
+      app.invalidate();
+  });
+  app.on("exit", () => client.stop());
+  const onAbort = () => app.stop();
+  signal?.addEventListener("abort", onAbort);
+  client.start();
+  if (!signal?.aborted)
+    await app.start();
+  signal?.removeEventListener("abort", onAbort);
+  client.stop();
+}
+
+// src/commands/dev.ts
+import { execFileSync, spawn as spawn3 } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { constants } from "os";
+import { dirname as dirname3, join as join4, resolve as resolve4 } from "path";
+import process6 from "process";
+import { setTimeout as delay } from "timers/promises";
+import { parseArgs as parseArgs3 } from "util";
+
+// src/dev/control.ts
+import { Buffer } from "buffer";
+import { randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+
+// ../core/dist/Plugins/install.js
+var DEV_CONTROL_URL_ENV = "MAVONENGINE_DEV_CONTROL_URL";
+var DEV_CONTROL_TOKEN_ENV = "MAVONENGINE_DEV_CONTROL_TOKEN";
+var DEV_CONTROL_TOKEN_HEADER = "x-mavonengine-dev-token";
+var MAX_INSTALL_PACKAGES = 10;
+var MAX_SPEC_LENGTH = 300;
+var PACKAGE_SPEC_RE = /^[\w@./~][\w@./:~=+#-]*$/;
+function invalidPackages(packages) {
+  if (!Array.isArray(packages) || packages.length === 0)
+    return "Expected { packages: [...] } with at least one package";
+  if (packages.length > MAX_INSTALL_PACKAGES)
+    return `At most ${MAX_INSTALL_PACKAGES} packages at a time`;
+  for (const spec of packages) {
+    if (typeof spec !== "string" || spec.length > MAX_SPEC_LENGTH || !PACKAGE_SPEC_RE.test(spec))
+      return `${JSON.stringify(spec)} is not something that can be installed from here: use a package name, name@version, a file: path or a URL, without spaces or version ranges like ^1.0.0`;
+  }
+  return void 0;
+}
+
+// src/commands/install.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3, resolve as resolve3 } from "path";
+import process5 from "process";
+import { createInterface } from "readline/promises";
+import { parseArgs as parseArgs2 } from "util";
+
+// src/create/project.ts
+import { spawn as spawn2 } from "child_process";
+import { createWriteStream, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2 } from "path";
+import process4 from "process";
+import { Readable, Transform } from "stream";
+import { pipeline } from "stream/promises";
+import AdmZip from "adm-zip";
+var TEMPLATE_URL = "https://github.com/MavonEngine/Core/archive/refs/tags/0.0.17-alpha.zip";
+var TEMPLATE_SUBPATH = "packages/multiplayer-template";
+var PROJECT_NAME_RE = /^[\w@./-][\w@./\- ]*$/;
+function projectDirFor(projectName, parentDir) {
+  return resolve2(parentDir, projectName);
+}
+async function downloadZip(url, { report, signal, fetch = globalThis.fetch }) {
+  const response = await fetch(url, { signal });
+  if (!response.ok || !response.body)
+    throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
+  const total = Number(response.headers.get("content-length")) || 0;
+  let received = 0;
+  const progress = new Transform({
+    transform(chunk, _encoding, callback) {
+      received += chunk.length;
+      report.step(`Downloading the template\u2026 ${formatBytes(received)}${total ? ` of ${formatBytes(total)}` : ""}`);
+      callback(null, chunk);
+    }
+  });
+  const dest = join2(tmpdir(), `mavonengine-create-${process4.pid}-${Date.now()}.zip`);
+  try {
+    await pipeline(Readable.fromWeb(response.body), progress, createWriteStream(dest), { signal });
+  } catch (err) {
+    rmSync(dest, { force: true });
+    throw err;
+  }
+  return dest;
+}
+function extractTemplate(zipPath, templateSubpath, destDir) {
+  const entries = new AdmZip(zipPath).getEntries();
+  if (entries.length === 0)
+    throw new Error("Downloaded zip archive is empty");
+  const rootFolder = entries[0].entryName.split("/")[0];
+  const templatePrefix = `${rootFolder}/${templateSubpath}/`;
+  const templateEntries = entries.filter((e) => e.entryName.startsWith(templatePrefix));
+  if (templateEntries.length === 0)
+    throw new Error(`Template path "${templateSubpath}" not found in zip archive (root: ${rootFolder})`);
+  const root = resolve2(destDir);
+  let files = 0;
+  for (const entry of templateEntries) {
+    const relativePath = entry.entryName.slice(templatePrefix.length);
+    if (!relativePath)
+      continue;
+    const outputPath = resolve2(root, relativePath);
+    const inside = relative2(root, outputPath);
+    if (inside.startsWith("..") || isAbsolute2(inside))
+      throw new Error(`Refusing to extract ${entry.entryName} outside the project`);
+    if (entry.isDirectory) {
+      mkdirSync(outputPath, { recursive: true });
+    } else {
+      mkdirSync(dirname2(outputPath), { recursive: true });
+      writeFileSync2(outputPath, entry.getData());
+      files++;
+    }
+  }
+  return files;
+}
+function runCommand(command, args, cwd, { report, signal }) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn2(command, args, {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      // npm is a .cmd shim on Windows
+      shell: process4.platform === "win32",
+      signal
+    });
+    child.stdout.setEncoding("utf8").on("data", report.output);
+    child.stderr.setEncoding("utf8").on("data", report.output);
+    child.on("error", (err) => {
+      reject(err.code === "ENOENT" ? new Error(`'${command}' was not found on your PATH`) : err);
+    });
+    child.on("exit", (code, exitSignal) => {
+      if (code === 0)
+        resolvePromise();
+      else
+        reject(new Error(`'${command} ${args.join(" ")}' ${code === null ? `was stopped by ${exitSignal}` : `exited with code ${code}`}`));
+    });
+  });
+}
+async function createProject({ projectName, parentDir, report, signal, templateUrl = TEMPLATE_URL, fetch, install = true }) {
+  const projectDir = projectDirFor(projectName, parentDir);
+  if (existsSync2(projectDir))
+    throw new Error(`Directory "${projectDir}" already exists`);
+  report.output(`Creating project "${projectName}" in ${projectDir}
+`);
+  mkdirSync(projectDir, { recursive: true });
+  report.step("Downloading the template\u2026");
+  report.output(`Downloading the template from ${templateUrl}
+`);
+  const zipPath = await downloadZip(templateUrl, { report, signal, fetch });
+  try {
+    report.step("Extracting the template\u2026");
+    const files = extractTemplate(zipPath, TEMPLATE_SUBPATH, projectDir);
+    report.output(`Extracted ${files} files
+`);
+  } finally {
+    rmSync(zipPath, { force: true });
+  }
+  const pkgJsonPath = join2(projectDir, "package.json");
+  if (existsSync2(pkgJsonPath)) {
+    const pkg = JSON.parse(readFileSync2(pkgJsonPath, "utf-8"));
+    pkg.name = projectName;
+    writeFileSync2(pkgJsonPath, `${JSON.stringify(pkg, null, 2)}
+`);
+  }
+  if (writeMcpConfig(projectDir))
+    report.output(`Wrote ${MCP_CONFIG_FILE} so AI assistants with MCP support can inspect the running game server
+`);
+  if (install) {
+    signal?.throwIfAborted();
+    report.step("Installing dependencies\u2026");
+    report.output("Running 'npm install'\n");
+    await runCommand("npm", ["install"], projectDir, { report, signal });
+  }
+  return projectDir;
+}
+
+// src/commands/install.ts
+var INSTALL_HELP = `Usage: mavonengine install <package...> [options]
+
+Install packages into the MavonEngine project you are in. For each one that is a
+MavonEngine plugin, asks whether to add it to the plugins in ${CONFIG_FILE}, so it
+loads on the client and/or the game server and is built into the release.
+
+Takes anything your package manager does: names, name@version, file: paths, git URLs.
+
+Options:
+  --cwd <dir>        Start looking for the project here (default: current directory)
+  -y, --yes          Add plugins to ${CONFIG_FILE} without asking
+  --no-register      Only install, leave ${CONFIG_FILE} alone
+  -h, --help         Show this help
+`;
+var PACKAGE_SPEC_RE2 = /^((?:@[\w.-]+\/)?[\w.-]+)(?:@.*)?$/;
+var LOCAL_PATH_RE = /^(?:\.{1,2}(?:[/\\]|$)|[/~]|[a-z]:[/\\])/i;
+var TARGET_LABELS = {
+  client: "client only",
+  server: "server only",
+  both: "client + server"
+};
+function parseInstallArgs(args, cwd = process5.cwd()) {
+  const { values, positionals } = parseArgs2({
+    args,
+    options: {
+      cwd: { type: "string" },
+      yes: { type: "boolean", short: "y", default: false },
+      register: { type: "boolean", default: true },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    strict: true,
+    allowPositionals: true,
+    allowNegative: true
+  });
+  if (values.help)
+    return "help";
+  if (positionals.length === 0)
+    throw new UsageError(`which package? e.g. mavonengine install my-plugin
+
+${INSTALL_HELP}`);
+  return { cwd: resolve3(cwd, values.cwd ?? "."), packages: positionals, yes: values.yes, register: values.register };
+}
+function packageNameFromSpec(spec, root) {
+  const localPath = spec.startsWith("file:") ? spec.slice("file:".length) : LOCAL_PATH_RE.test(spec) ? spec : void 0;
+  if (localPath !== void 0) {
+    const packageJson = join3(resolve3(root, localPath), "package.json");
+    try {
+      return existsSync3(packageJson) ? JSON.parse(readFileSync3(packageJson, "utf8")).name : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  if (spec.includes(":") || spec.endsWith(".tgz"))
+    return void 0;
+  return PACKAGE_SPEC_RE2.exec(spec)?.[1];
+}
+function installArgs(pm, packages) {
+  return [pm === "npm" ? "install" : "add", ...packages];
+}
+function dependencyNames(root) {
+  const path = join3(root, "package.json");
+  if (!existsSync3(path))
+    return /* @__PURE__ */ new Map();
+  const pkg = JSON.parse(readFileSync3(path, "utf8"));
+  return new Map(Object.entries({ ...pkg.devDependencies, ...pkg.dependencies }));
+}
+function installedNames(specs, root, before, after) {
+  const names = specs.map((spec) => packageNameFromSpec(spec, root)).filter((name) => !!name);
+  for (const [name, version2] of after) {
+    if (before.get(name) !== version2)
+      names.push(name);
+  }
+  return [...new Set(names)];
+}
+function describePlugin(plugin, engineVersion) {
+  const { manifest } = plugin;
+  const lines = [`${plugin.package}${plugin.version ? `@${plugin.version}` : ""} is a MavonEngine plugin (${TARGET_LABELS[manifest.target]})`];
+  const prefabs = Object.keys(manifest.assets?.prefabs ?? {});
+  if (prefabs.length)
+    lines.push(`  Prefabs: ${prefabs.join(", ")}. Their assets ship in the release once you place them in the editor`);
+  if (manifest.engine)
+    lines.push(`  Made for @mavonengine/core ${manifest.engine}${engineVersion ? `, you have ${engineVersion}` : ""}`);
+  return `${lines.join("\n")}
+`;
+}
+function confirmOnTerminal(question) {
+  const rl = createInterface({ input: process5.stdin, output: process5.stdout });
+  return rl.question(question).then((answer) => ["", "y", "yes"].includes(answer.trim().toLowerCase())).finally(() => rl.close());
+}
+var terminalIO = {
+  run: (command, args, cwd) => runCommand(command, args, cwd, {
+    report: { step: () => {
+    }, output: (chunk) => process5.stdout.write(chunk) }
+  }),
+  confirm: confirmOnTerminal,
+  get interactive() {
+    return !!process5.stdin.isTTY && !!process5.stdout.isTTY;
+  },
+  write: (text) => process5.stdout.write(text)
+};
+async function runInstallCommand(options, io = terminalIO) {
+  const root = findProjectRoot(options.cwd);
+  if (!root)
+    throw new UsageError(`no MavonEngine project found in ${options.cwd} or its parents (looking for a package.json with @mavonengine/core and a dev script)`);
+  const config = readConfig(root);
+  const pm = detectPackageManager(root);
+  const args = installArgs(pm, options.packages);
+  const before = dependencyNames(root);
+  io.write(`mavonengine: running '${pm} ${args.join(" ")}' in ${root}
+`);
+  await io.run(pm, args, root);
+  const engineVersion = installedEngineVersion(root);
+  let failed = false;
+  const names = installedNames(options.packages, root, before, dependencyNames(root));
+  if (names.length === 0)
+    io.write(`
+mavonengine: couldn't tell which packages were installed. If one is a plugin, run 'mavonengine install <its name>' to register it
+`);
+  for (const name of names) {
+    let plugin;
+    try {
+      plugin = readPluginManifest(root, name);
+    } catch (err) {
+      io.write(`
+mavonengine: ${err.message}
+`);
+      failed = true;
+      continue;
+    }
+    if (!plugin) {
+      io.write(`
+${name} is installed. It is not a MavonEngine plugin (no "mavonengine" field in its package.json), so ${CONFIG_FILE} is left alone
+`);
+      continue;
+    }
+    io.write(`
+${describePlugin(plugin, engineVersion)}`);
+    const entry = config.plugins[name];
+    if (entry && entry.enabled !== false) {
+      io.write(`  Already in ${CONFIG_FILE}
+`);
+      continue;
+    }
+    if (!options.register)
+      continue;
+    if (!options.yes && !io.interactive) {
+      io.write(`  Not added to ${CONFIG_FILE}: run with --yes, or add "${name}": { "enabled": true } to its "plugins"
+`);
+      continue;
+    }
+    if (!options.yes && !await io.confirm(`Add ${name} to the plugins in ${CONFIG_FILE}? (Y/n) `)) {
+      io.write(`  Not added. Add "${name}": { "enabled": true } to "plugins" in ${CONFIG_FILE} to use it later
+`);
+      continue;
+    }
+    addPluginToConfig(root, name);
+    io.write(`  Added to ${join3(root, CONFIG_FILE)}
+`);
+    if (plugin.manifest.target !== "client")
+      io.write(`  Restart the game server ('mavonengine dev') to load it there
+`);
+  }
+  return failed ? 1 : 0;
+}
+
+// src/dev/installer.ts
+var MAX_INSTALL_OUTPUT = 2e4;
+var InstallRefused = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+  reason;
+};
+function installWithCli(root, packages, write) {
+  return runInstallCommand({ cwd: root, packages, yes: true, register: true }, {
+    run: (command, args, cwd) => runCommand(command, args, cwd, { report: { step: () => {
+    }, output: write } }),
+    // Whoever asked for the install already agreed to it
+    confirm: async () => true,
+    interactive: false,
+    write
+  });
+}
+var PluginInstaller = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  /** The running or last install */
+  job = null;
+  /** Settles when the current install and the restart after it are over */
+  finished = Promise.resolve();
+  nextId = 1;
+  listeners = /* @__PURE__ */ new Set();
+  get busy() {
+    return this.job?.status === "installing" || this.job?.status === "restarting";
+  }
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Start installing `packages`. Throws InstallRefused when they can't be installed or an install is running.
+   */
+  start(packages) {
+    const invalid = invalidPackages(packages);
+    if (invalid)
+      throw new InstallRefused(invalid, "invalid");
+    if (this.busy)
+      throw new InstallRefused(`Still installing ${this.job.packages.join(", ")}`, "busy");
+    const job = { id: this.nextId++, packages: [...packages], status: "installing", output: "" };
+    this.job = job;
+    this.finished = this.run(job);
+    return job;
+  }
+  async run(job) {
+    const changed = () => this.listeners.forEach((listener) => listener(job));
+    const write = (text) => {
+      job.output = (job.output + text).slice(-MAX_INSTALL_OUTPUT);
+      changed();
+    };
+    changed();
+    try {
+      const code = await (this.options.install ?? installWithCli)(this.options.root, job.packages, write);
+      if (code !== 0)
+        throw new Error("The packages were installed, but not all of them could be set up as plugins");
+      job.status = "restarting";
+      write("\nmavonengine: restarting the dev script to load what was installed\n");
+      await this.options.restart();
+      job.status = "done";
+    } catch (err) {
+      job.status = "failed";
+      job.error = err.message;
+    }
+    changed();
+  }
+};
+
+// src/dev/control.ts
+var MAX_BODY_BYTES = 8192;
+function readBody(req) {
+  return new Promise((resolve7, reject) => {
+    let body = "";
+    req.setEncoding("utf8");
+    req.on("data", (chunk) => {
+      body += chunk;
+      if (body.length > MAX_BODY_BYTES) {
+        reject(new Error("Body too large"));
+        req.destroy();
+      }
+    });
+    req.on("end", () => resolve7(body));
+    req.on("error", reject);
+  });
+}
+function sameToken(given, token) {
+  if (typeof given !== "string")
+    return false;
+  const a = Buffer.from(given);
+  const b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function startDevControl(installer) {
+  const token = randomBytes(24).toString("hex");
+  const handle = async (req, res) => {
+    const reply = (status, body) => {
+      res.statusCode = status;
+      res.setHeader("Content-Type", "application/json");
+      res.end(JSON.stringify(body));
+    };
+    if (!sameToken(req.headers[DEV_CONTROL_TOKEN_HEADER], token)) {
+      reply(401, { error: "Wrong or missing token" });
+      return;
+    }
+    if (req.method === "GET" && req.url === "/status") {
+      reply(200, { job: installer.job });
+      return;
+    }
+    if (req.method === "POST" && req.url === "/install") {
+      let packages;
+      try {
+        ({ packages } = JSON.parse(await readBody(req)));
+      } catch {
+        reply(400, { error: "Expected a JSON body" });
+        return;
+      }
+      try {
+        reply(202, { job: installer.start(packages) });
+      } catch (err) {
+        if (!(err instanceof InstallRefused))
+          throw err;
+        reply(err.reason === "busy" ? 409 : 400, { error: err.message });
+      }
+      return;
+    }
+    reply(404, { error: "Not found" });
+  };
+  const server = createServer((req, res) => {
+    handle(req, res).catch((err) => {
+      res.statusCode = 500;
+      res.end(JSON.stringify({ error: err.message }));
+    });
+  });
+  return new Promise((resolve7, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const url = `http://127.0.0.1:${server.address().port}`;
+      resolve7({
+        url,
+        token,
+        env: { [DEV_CONTROL_URL_ENV]: url, [DEV_CONTROL_TOKEN_ENV]: token },
+        close: () => new Promise((done) => {
+          server.close(() => done());
+          server.closeAllConnections();
+        })
+      });
+    });
+  });
+}
+
+// src/commands/dev.ts
+var DEV_HELP = `Usage: mavonengine dev [options]
+
+Run the dev servers of the MavonEngine project you are in (game server and client)
+and show the dashboard for it. Once the game server is up, the game opens in the
+browser. Quitting the dashboard stops the dev servers.
+
+Runs the project's 'dev:server' script, or its 'dev' script when there is none.
 So 'dev' can be 'mavonengine dev' itself, as in the multiplayer template.
 
 Options:
@@ -1456,8 +2976,8 @@ var DEV_FLAGS = {
   open: { type: "boolean", default: true },
   help: { type: "boolean", short: "h", default: false }
 };
-function parseDevArgs(args, cwd = process3.cwd(), env = process3.env) {
-  const { values } = parseArgs2({
+function parseDevArgs(args, cwd = process6.cwd(), env = process6.env) {
+  const { values } = parseArgs3({
     args,
     options: DEV_FLAGS,
     strict: true,
@@ -1479,14 +2999,14 @@ function toDevOptions(values, cwd, env) {
     dashboard = parseDashboardArgs(dashboardArgs, env);
     dashboard.openBrowser = values.open && canOpenBrowserHere(env);
   }
-  return { cwd: resolve2(cwd, values.cwd ?? "."), dashboard };
+  return { cwd: resolve4(cwd, values.cwd ?? "."), dashboard };
 }
 function readPackageJson(dir) {
-  const path = join2(dir, "package.json");
-  if (!existsSync2(path))
+  const path = join4(dir, "package.json");
+  if (!existsSync4(path))
     return void 0;
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -1497,11 +3017,11 @@ function devScriptOf(pkg) {
     return DEV_SERVER_SCRIPT;
   return typeof scripts.dev === "string" ? "dev" : void 0;
 }
-function checkDevScript(root, env = process3.env) {
+function checkDevScript(root, env = process6.env) {
   const pkg = readPackageJson(root);
   const script = devScriptOf(pkg);
   if (!script)
-    throw new UsageError(`${join2(root, "package.json")} has no '${DEV_SERVER_SCRIPT}' or 'dev' script`);
+    throw new UsageError(`${join4(root, "package.json")} has no '${DEV_SERVER_SCRIPT}' or 'dev' script`);
   const command = String(pkg?.scripts?.[script] ?? "");
   if (env[DEV_ENV_FLAG] || RUNS_MAVONENGINE_DEV_RE.test(command)) {
     throw new UsageError(`the '${script}' script starts 'mavonengine dev' again. Put the command that starts the game server in a '${DEV_SERVER_SCRIPT}' script: 'mavonengine dev' runs that instead of 'dev'`);
@@ -1509,20 +3029,20 @@ function checkDevScript(root, env = process3.env) {
   return script;
 }
 function findProjectRoot(start) {
-  for (let dir = resolve2(start); ; dir = dirname2(dir)) {
+  for (let dir = resolve4(start); ; dir = dirname3(dir)) {
     const pkg = readPackageJson(dir);
     const deps = { ...pkg?.dependencies, ...pkg?.devDependencies };
     if ("@mavonengine/core" in deps && devScriptOf(pkg))
       return dir;
-    if (dirname2(dir) === dir)
+    if (dirname3(dir) === dir)
       return void 0;
   }
 }
 function installedEngineVersion(root) {
-  return readPackageJson(join2(root, "node_modules", "@mavonengine", "core"))?.version;
+  return readPackageJson(join4(root, "node_modules", "@mavonengine", "core"))?.version;
 }
 function detectPackageManager(root) {
-  return LOCKFILES.find(([file]) => existsSync2(join2(root, file)))?.[1] ?? "npm";
+  return LOCKFILES.find(([file]) => existsSync4(join4(root, file)))?.[1] ?? "npm";
 }
 function descendants(root, psOutput) {
   const children = /* @__PURE__ */ new Map();
@@ -1543,7 +3063,7 @@ function descendants(root, psOutput) {
   return found;
 }
 function processTree(pid) {
-  if (process3.platform === "win32")
+  if (process6.platform === "win32")
     return [];
   try {
     return [pid, ...descendants(pid, execFileSync("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" }))];
@@ -1554,14 +3074,14 @@ function processTree(pid) {
 function signalAll(pids, signal) {
   for (const p of pids) {
     try {
-      process3.kill(p, signal);
+      process6.kill(p, signal);
     } catch {
     }
   }
 }
 function isAlive(pid) {
   try {
-    process3.kill(pid, 0);
+    process6.kill(pid, 0);
     return true;
   } catch {
     return false;
@@ -1573,7 +3093,7 @@ async function waitForExit(pids, timeoutMs) {
     await delay(50);
 }
 function killTree(pid, signal) {
-  if (process3.platform === "win32") {
+  if (process6.platform === "win32") {
     try {
       execFileSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
     } catch {
@@ -1582,15 +3102,15 @@ function killTree(pid, signal) {
   }
   signalAll(processTree(pid), signal);
 }
-function startDev(root, { capture = false } = {}) {
+function startDev(root, { capture = false, env = {} } = {}) {
   const pm = detectPackageManager(root);
   const script = checkDevScript(root);
-  const child = spawn2(pm, ["run", script], {
+  const child = spawn3(pm, ["run", script], {
     cwd: root,
-    env: { ...process3.env, [DEV_ENV_FLAG]: "1" },
+    env: { ...process6.env, ...env, [DEV_ENV_FLAG]: "1" },
     stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit",
     // npm, pnpm and yarn are .cmd shims on Windows
-    shell: process3.platform === "win32"
+    shell: process6.platform === "win32"
   });
   let output = "";
   const keep = (chunk) => {
@@ -1601,7 +3121,7 @@ function startDev(root, { capture = false } = {}) {
   if (capture)
     keep(announce);
   else
-    process3.stdout.write(announce);
+    process6.stdout.write(announce);
   child.stdout?.setEncoding("utf8").on("data", keep);
   child.stderr?.setEncoding("utf8").on("data", keep);
   let running = true;
@@ -1609,17 +3129,17 @@ function startDev(root, { capture = false } = {}) {
   };
   const forward = (signal) => child.pid && killTree(child.pid, signal);
   const onExit = () => running && child.pid && killTree(child.pid, "SIGTERM");
-  process3.on("SIGINT", onInterrupt);
-  process3.on("SIGTERM", forward);
-  process3.on("SIGHUP", forward);
-  process3.on("exit", onExit);
+  process6.on("SIGINT", onInterrupt);
+  process6.on("SIGTERM", forward);
+  process6.on("SIGHUP", forward);
+  process6.on("exit", onExit);
   const exited = new Promise((resolvePromise, reject) => {
     const cleanup = () => {
       running = false;
-      process3.off("SIGINT", onInterrupt);
-      process3.off("SIGTERM", forward);
-      process3.off("SIGHUP", forward);
-      process3.off("exit", onExit);
+      process6.off("SIGINT", onInterrupt);
+      process6.off("SIGTERM", forward);
+      process6.off("SIGHUP", forward);
+      process6.off("exit", onExit);
     };
     child.on("error", (err) => {
       cleanup();
@@ -1632,7 +3152,7 @@ function startDev(root, { capture = false } = {}) {
   });
   const stop = async () => {
     if (running && child.pid) {
-      if (process3.platform === "win32") {
+      if (process6.platform === "win32") {
         killTree(child.pid, "SIGTERM");
       } else {
         const tree = processTree(child.pid);
@@ -1646,28 +3166,83 @@ function startDev(root, { capture = false } = {}) {
   };
   return { exited, stop, output: () => output };
 }
-function runDev(root) {
-  return startDev(root).exited;
+function startDevSession(root, options = {}) {
+  let dev = startDev(root, options);
+  let restarting = false;
+  let settle;
+  const exited = new Promise((resolve7, reject) => settle = { resolve: resolve7, reject });
+  const watch = (current) => {
+    current.exited.then((code) => {
+      if (current === dev && !restarting)
+        settle.resolve(code);
+    }, (err) => settle.reject(err));
+  };
+  watch(dev);
+  return {
+    exited,
+    output: () => dev.output(),
+    stop: () => dev.stop(),
+    async restart() {
+      restarting = true;
+      try {
+        await dev.stop().catch(() => {
+        });
+        dev = startDev(root, options);
+      } finally {
+        restarting = false;
+      }
+      watch(dev);
+    }
+  };
+}
+async function startDevWithInstaller(root, { capture = false, onOutput } = {}) {
+  let session;
+  const installer = new PluginInstaller({ root, restart: async () => session?.restart() });
+  const control = await startDevControl(installer);
+  let written = 0;
+  installer.onChange((job) => {
+    onOutput?.(job.output.slice(written <= job.output.length ? written : 0));
+    written = job.output.length;
+    if (job.status === "done" || job.status === "failed")
+      written = 0;
+  });
+  try {
+    session = startDevSession(root, { capture, env: control.env });
+  } catch (err) {
+    await control.close();
+    throw err;
+  }
+  return { session, installer, close: () => control.close() };
+}
+async function runDev(root) {
+  const { session, close } = await startDevWithInstaller(root, { onOutput: (text) => process6.stdout.write(text) });
+  try {
+    return await session.exited;
+  } finally {
+    await close();
+  }
 }
 async function runDevWithDashboard(root, dashboard) {
-  const dev = startDev(root, { capture: true });
+  const { session: dev, installer, close } = await startDevWithInstaller(root, { capture: true });
   const engineVersion = installedEngineVersion(root);
   const startup = () => ({ engineVersion, output: dev.output() });
   const devExited = new AbortController();
   dev.exited.then(() => devExited.abort(), () => devExited.abort());
   let quit = false;
   try {
-    await runDashboard({ ...dashboard, startup }, devExited.signal);
+    await runDashboard({ ...dashboard, startup, installer }, devExited.signal);
   } finally {
     quit = !devExited.signal.aborted;
+    await installer.finished;
     if (quit)
       await dev.stop().catch(() => {
       });
+    await close();
   }
   if (quit)
     return 0;
   const exitCode = await dev.exited;
-  process3.stderr.write(`${dev.output()}
+  process6.stderr.write(`${dev.output()}
 mavonengine: the dev script exited with code ${exitCode}
 `);
   return exitCode;
@@ -1677,7 +3252,7 @@ async function runDevCommand(options) {
   if (!root)
     throw new UsageError(`no MavonEngine project found in ${options.cwd} or its parents (looking for a package.json with @mavonengine/core and a dev script)`);
   checkDevScript(root);
-  if (options.dashboard && process3.stdout.isTTY && process3.stdin.isTTY)
+  if (options.dashboard && process6.stdout.isTTY && process6.stdin.isTTY)
     return runDevWithDashboard(root, options.dashboard);
   return runDev(root);
 }
@@ -1693,8 +3268,8 @@ Options:
   --cwd <dir>        Start looking for the project here (default: current directory)
   -h, --help         Show this help
 `;
-function parseBuildArgs(args, cwd = process4.cwd()) {
-  const { values } = parseArgs3({
+function parseBuildArgs(args, cwd = process7.cwd()) {
+  const { values } = parseArgs4({
     args,
     options: {
       cwd: { type: "string" },
@@ -1705,7 +3280,7 @@ function parseBuildArgs(args, cwd = process4.cwd()) {
   });
   if (values.help)
     return "help";
-  return { cwd: resolve3(cwd, values.cwd ?? ".") };
+  return { cwd: resolve5(cwd, values.cwd ?? ".") };
 }
 function summarizeReleaseAssets(root, assets, warnings) {
   const plugins = readConfig(root).plugins;
@@ -1723,172 +3298,44 @@ Plugins in ${CONFIG_FILE}:`];
     lines.push(`  warning: ${warning}`);
   return `${lines.join("\n")}
 `;
-}
-function run(command, args, cwd) {
-  return new Promise((resolvePromise, reject) => {
-    const child = spawn3(command, args, { cwd, stdio: "inherit", shell: process4.platform === "win32" });
-    child.on("error", (err) => {
-      reject(err.code === "ENOENT" ? new Error(`'${command}' was not found on your PATH`) : err);
-    });
-    child.on("exit", (code) => resolvePromise(code ?? 1));
-  });
-}
-async function runBuildCommand(options) {
-  const root = findProjectRoot(options.cwd);
-  if (!root)
-    throw new UsageError(`no MavonEngine project found in ${options.cwd} or its parents (looking for a package.json with @mavonengine/core and a dev script)`);
-  const pkg = JSON.parse(readFileSync3(join3(root, "package.json"), "utf8"));
-  if (typeof pkg.scripts?.build !== "string")
-    throw new UsageError(`${join3(root, "package.json")} has no build script`);
-  const pm = detectPackageManager(root);
-  process4.stdout.write(`mavonengine: running '${pm} run build' in ${root}
-`);
-  const code = await run(pm, ["run", "build"], root);
-  if (code !== 0) {
-    process4.stderr.write(`mavonengine: the build script exited with code ${code}
-`);
-    return code;
-  }
-  if (existsSync3(join3(root, CONFIG_FILE))) {
-    const { assets, warnings } = releaseAssets(root);
-    process4.stdout.write(summarizeReleaseAssets(root, assets, warnings));
-  }
-  return 0;
-}
-
-// src/commands/create.ts
-import { existsSync as existsSync5 } from "fs";
-import process6 from "process";
-import { createInterface } from "readline/promises";
-import { parseArgs as parseArgs4 } from "util";
-
-// src/create/project.ts
-import { spawn as spawn4 } from "child_process";
-import { createWriteStream, existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir } from "os";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve4 } from "path";
-import process5 from "process";
-import { Readable, Transform } from "stream";
-import { pipeline } from "stream/promises";
-import AdmZip from "adm-zip";
-var TEMPLATE_URL = "https://github.com/MavonEngine/Core/archive/refs/tags/0.0.16-alpha.zip";
-var TEMPLATE_SUBPATH = "packages/multiplayer-template";
-var PROJECT_NAME_RE = /^[\w@./-][\w@./\- ]*$/;
-function projectDirFor(projectName, parentDir) {
-  return resolve4(parentDir, projectName);
-}
-async function downloadZip(url, { report, signal, fetch = globalThis.fetch }) {
-  const response = await fetch(url, { signal });
-  if (!response.ok || !response.body)
-    throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
-  const total = Number(response.headers.get("content-length")) || 0;
-  let received = 0;
-  const progress = new Transform({
-    transform(chunk, _encoding, callback) {
-      received += chunk.length;
-      report.step(`Downloading the template\u2026 ${formatBytes(received)}${total ? ` of ${formatBytes(total)}` : ""}`);
-      callback(null, chunk);
-    }
-  });
-  const dest = join4(tmpdir(), `mavonengine-create-${process5.pid}-${Date.now()}.zip`);
-  try {
-    await pipeline(Readable.fromWeb(response.body), progress, createWriteStream(dest), { signal });
-  } catch (err) {
-    rmSync(dest, { force: true });
-    throw err;
-  }
-  return dest;
-}
-function extractTemplate(zipPath, templateSubpath, destDir) {
-  const entries = new AdmZip(zipPath).getEntries();
-  if (entries.length === 0)
-    throw new Error("Downloaded zip archive is empty");
-  const rootFolder = entries[0].entryName.split("/")[0];
-  const templatePrefix = `${rootFolder}/${templateSubpath}/`;
-  const templateEntries = entries.filter((e) => e.entryName.startsWith(templatePrefix));
-  if (templateEntries.length === 0)
-    throw new Error(`Template path "${templateSubpath}" not found in zip archive (root: ${rootFolder})`);
-  const root = resolve4(destDir);
-  let files = 0;
-  for (const entry of templateEntries) {
-    const relativePath = entry.entryName.slice(templatePrefix.length);
-    if (!relativePath)
-      continue;
-    const outputPath = resolve4(root, relativePath);
-    const inside = relative2(root, outputPath);
-    if (inside.startsWith("..") || isAbsolute2(inside))
-      throw new Error(`Refusing to extract ${entry.entryName} outside the project`);
-    if (entry.isDirectory) {
-      mkdirSync(outputPath, { recursive: true });
-    } else {
-      mkdirSync(dirname3(outputPath), { recursive: true });
-      writeFileSync2(outputPath, entry.getData());
-      files++;
-    }
-  }
-  return files;
-}
-function runCommand(command, args, cwd, { report, signal }) {
-  return new Promise((resolvePromise, reject) => {
-    const child = spawn4(command, args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      // npm is a .cmd shim on Windows
-      shell: process5.platform === "win32",
-      signal
-    });
-    child.stdout.setEncoding("utf8").on("data", report.output);
-    child.stderr.setEncoding("utf8").on("data", report.output);
+}
+function run(command, args, cwd) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn4(command, args, { cwd, stdio: "inherit", shell: process7.platform === "win32" });
     child.on("error", (err) => {
       reject(err.code === "ENOENT" ? new Error(`'${command}' was not found on your PATH`) : err);
     });
-    child.on("exit", (code, exitSignal) => {
-      if (code === 0)
-        resolvePromise();
-      else
-        reject(new Error(`'${command} ${args.join(" ")}' ${code === null ? `was stopped by ${exitSignal}` : `exited with code ${code}`}`));
-    });
+    child.on("exit", (code) => resolvePromise(code ?? 1));
   });
 }
-async function createProject({ projectName, parentDir, report, signal, templateUrl = TEMPLATE_URL, fetch, install = true }) {
-  const projectDir = projectDirFor(projectName, parentDir);
-  if (existsSync4(projectDir))
-    throw new Error(`Directory "${projectDir}" already exists`);
-  report.output(`Creating project "${projectName}" in ${projectDir}
-`);
-  mkdirSync(projectDir, { recursive: true });
-  report.step("Downloading the template\u2026");
-  report.output(`Downloading the template from ${templateUrl}
-`);
-  const zipPath = await downloadZip(templateUrl, { report, signal, fetch });
-  try {
-    report.step("Extracting the template\u2026");
-    const files = extractTemplate(zipPath, TEMPLATE_SUBPATH, projectDir);
-    report.output(`Extracted ${files} files
+async function runBuildCommand(options) {
+  const root = findProjectRoot(options.cwd);
+  if (!root)
+    throw new UsageError(`no MavonEngine project found in ${options.cwd} or its parents (looking for a package.json with @mavonengine/core and a dev script)`);
+  const pkg = JSON.parse(readFileSync5(join5(root, "package.json"), "utf8"));
+  if (typeof pkg.scripts?.build !== "string")
+    throw new UsageError(`${join5(root, "package.json")} has no build script`);
+  const pm = detectPackageManager(root);
+  process7.stdout.write(`mavonengine: running '${pm} run build' in ${root}
 `);
-  } finally {
-    rmSync(zipPath, { force: true });
-  }
-  const pkgJsonPath = join4(projectDir, "package.json");
-  if (existsSync4(pkgJsonPath)) {
-    const pkg = JSON.parse(readFileSync4(pkgJsonPath, "utf-8"));
-    pkg.name = projectName;
-    writeFileSync2(pkgJsonPath, `${JSON.stringify(pkg, null, 2)}
+  const code = await run(pm, ["run", "build"], root);
+  if (code !== 0) {
+    process7.stderr.write(`mavonengine: the build script exited with code ${code}
 `);
+    return code;
   }
-  if (writeMcpConfig(projectDir))
-    report.output(`Wrote ${MCP_CONFIG_FILE} so AI assistants with MCP support can inspect the running game server
-`);
-  if (install) {
-    signal?.throwIfAborted();
-    report.step("Installing dependencies\u2026");
-    report.output("Running 'npm install'\n");
-    await runCommand("npm", ["install"], projectDir, { report, signal });
+  if (existsSync5(join5(root, CONFIG_FILE))) {
+    const { assets, warnings } = releaseAssets(root);
+    process7.stdout.write(summarizeReleaseAssets(root, assets, warnings));
   }
-  return projectDir;
+  return 0;
 }
 
 // src/commands/create.ts
+import { existsSync as existsSync6 } from "fs";
+import process8 from "process";
+import { createInterface as createInterface2 } from "readline/promises";
+import { parseArgs as parseArgs5 } from "util";
 var CREATE_HELP = `Usage: mavonengine create [name] [options]
 
 Create a MavonEngine project from the multiplayer template, install its
@@ -1904,8 +3351,8 @@ Options:
   -h, --help         Show this help
 `;
 var MAX_SETUP_OUTPUT = 64 * 1024;
-function parseCreateArgs(args, cwd = process6.cwd(), env = process6.env) {
-  const { values, positionals } = parseArgs4({
+function parseCreateArgs(args, cwd = process8.cwd(), env = process8.env) {
+  const { values, positionals } = parseArgs5({
     args,
     options: DEV_FLAGS,
     strict: true,
@@ -1926,7 +3373,7 @@ function checkProjectName(name) {
     throw new UsageError(`invalid project name '${name}'`);
 }
 async function promptProjectName() {
-  const rl = createInterface({ input: process6.stdin, output: process6.stdout });
+  const rl = createInterface2({ input: process8.stdin, output: process8.stdout });
   try {
     return (await rl.question("Project name: ")).trim();
   } finally {
@@ -1980,18 +3427,18 @@ async function runCreateWithDashboard(projectName, parentDir, dashboard) {
       return 0;
     await work.catch(() => {
     });
-    process6.stderr.write(`mavonengine: stopped creating the project, what was set up so far is in ${projectDirFor(projectName, parentDir)}
+    process8.stderr.write(`mavonengine: stopped creating the project, what was set up so far is in ${projectDirFor(projectName, parentDir)}
 `);
     return 130;
   }
   try {
     const exitCode = await work;
-    process6.stderr.write(`${dev.output()}
+    process8.stderr.write(`${dev.output()}
 mavonengine: the dev script exited with code ${exitCode}
 `);
     return exitCode;
   } catch (err) {
-    process6.stderr.write(output);
+    process8.stderr.write(output);
     throw err;
   }
 }
@@ -1999,16 +3446,16 @@ async function runCreatePlain(projectName, parentDir) {
   const report = {
     step: () => {
     },
-    output: (chunk) => process6.stdout.write(chunk)
+    output: (chunk) => process8.stdout.write(chunk)
   };
   const dir = await createProject({ projectName, parentDir, report });
-  process6.stdout.write(`
+  process8.stdout.write(`
 mavonengine: your project is ready at ${dir}
 `);
   return runDev(dir);
 }
 async function runCreateCommand(options) {
-  const interactive = !!process6.stdout.isTTY && !!process6.stdin.isTTY;
+  const interactive = !!process8.stdout.isTTY && !!process8.stdin.isTTY;
   let projectName = options.projectName;
   if (!projectName) {
     if (!interactive)
@@ -2019,191 +3466,24 @@ async function runCreateCommand(options) {
     checkProjectName(projectName);
   }
   const dir = projectDirFor(projectName, options.cwd);
-  if (existsSync5(dir))
+  if (existsSync6(dir))
     throw new UsageError(`${dir} already exists`);
   if (options.dashboard && interactive)
     return runCreateWithDashboard(projectName, options.cwd, options.dashboard);
   return runCreatePlain(projectName, options.cwd);
 }
 
-// src/commands/install.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { join as join5, resolve as resolve5 } from "path";
-import process7 from "process";
-import { createInterface as createInterface2 } from "readline/promises";
-import { parseArgs as parseArgs5 } from "util";
-var INSTALL_HELP = `Usage: mavonengine install <package...> [options]
-
-Install packages into the MavonEngine project you are in. For each one that is a
-MavonEngine plugin, asks whether to add it to the plugins in ${CONFIG_FILE}, so it
-loads on the client and/or the game server and is built into the release.
-
-Takes anything your package manager does: names, name@version, file: paths, git URLs.
-
-Options:
-  --cwd <dir>        Start looking for the project here (default: current directory)
-  -y, --yes          Add plugins to ${CONFIG_FILE} without asking
-  --no-register      Only install, leave ${CONFIG_FILE} alone
-  -h, --help         Show this help
-`;
-var PACKAGE_SPEC_RE = /^((?:@[\w.-]+\/)?[\w.-]+)(?:@.*)?$/;
-var LOCAL_PATH_RE = /^(?:\.{1,2}(?:[/\\]|$)|[/~]|[a-z]:[/\\])/i;
-var TARGET_LABELS = {
-  client: "client only",
-  server: "server only",
-  both: "client + server"
-};
-function parseInstallArgs(args, cwd = process7.cwd()) {
-  const { values, positionals } = parseArgs5({
-    args,
-    options: {
-      cwd: { type: "string" },
-      yes: { type: "boolean", short: "y", default: false },
-      register: { type: "boolean", default: true },
-      help: { type: "boolean", short: "h", default: false }
-    },
-    strict: true,
-    allowPositionals: true,
-    allowNegative: true
-  });
-  if (values.help)
-    return "help";
-  if (positionals.length === 0)
-    throw new UsageError(`which package? e.g. mavonengine install my-plugin
-
-${INSTALL_HELP}`);
-  return { cwd: resolve5(cwd, values.cwd ?? "."), packages: positionals, yes: values.yes, register: values.register };
-}
-function packageNameFromSpec(spec, root) {
-  const localPath = spec.startsWith("file:") ? spec.slice("file:".length) : LOCAL_PATH_RE.test(spec) ? spec : void 0;
-  if (localPath !== void 0) {
-    const packageJson = join5(resolve5(root, localPath), "package.json");
-    try {
-      return existsSync6(packageJson) ? JSON.parse(readFileSync5(packageJson, "utf8")).name : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-  if (spec.includes(":") || spec.endsWith(".tgz"))
-    return void 0;
-  return PACKAGE_SPEC_RE.exec(spec)?.[1];
-}
-function installArgs(pm, packages) {
-  return [pm === "npm" ? "install" : "add", ...packages];
-}
-function dependencyNames(root) {
-  const path = join5(root, "package.json");
-  if (!existsSync6(path))
-    return /* @__PURE__ */ new Map();
-  const pkg = JSON.parse(readFileSync5(path, "utf8"));
-  return new Map(Object.entries({ ...pkg.devDependencies, ...pkg.dependencies }));
-}
-function installedNames(specs, root, before, after) {
-  const names = specs.map((spec) => packageNameFromSpec(spec, root)).filter((name) => !!name);
-  for (const [name, version2] of after) {
-    if (before.get(name) !== version2)
-      names.push(name);
-  }
-  return [...new Set(names)];
-}
-function describePlugin(plugin, engineVersion) {
-  const { manifest } = plugin;
-  const lines = [`${plugin.package}${plugin.version ? `@${plugin.version}` : ""} is a MavonEngine plugin (${TARGET_LABELS[manifest.target]})`];
-  const prefabs = Object.keys(manifest.assets?.prefabs ?? {});
-  if (prefabs.length)
-    lines.push(`  Prefabs: ${prefabs.join(", ")}. Their assets ship in the release once you place them in the editor`);
-  if (manifest.engine)
-    lines.push(`  Made for @mavonengine/core ${manifest.engine}${engineVersion ? `, you have ${engineVersion}` : ""}`);
-  return `${lines.join("\n")}
-`;
-}
-function confirmOnTerminal(question) {
-  const rl = createInterface2({ input: process7.stdin, output: process7.stdout });
-  return rl.question(question).then((answer) => ["", "y", "yes"].includes(answer.trim().toLowerCase())).finally(() => rl.close());
-}
-var terminalIO = {
-  run: (command, args, cwd) => runCommand(command, args, cwd, {
-    report: { step: () => {
-    }, output: (chunk) => process7.stdout.write(chunk) }
-  }),
-  confirm: confirmOnTerminal,
-  get interactive() {
-    return !!process7.stdin.isTTY && !!process7.stdout.isTTY;
-  },
-  write: (text) => process7.stdout.write(text)
-};
-async function runInstallCommand(options, io = terminalIO) {
-  const root = findProjectRoot(options.cwd);
-  if (!root)
-    throw new UsageError(`no MavonEngine project found in ${options.cwd} or its parents (looking for a package.json with @mavonengine/core and a dev script)`);
-  const config = readConfig(root);
-  const pm = detectPackageManager(root);
-  const args = installArgs(pm, options.packages);
-  const before = dependencyNames(root);
-  io.write(`mavonengine: running '${pm} ${args.join(" ")}' in ${root}
-`);
-  await io.run(pm, args, root);
-  const engineVersion = installedEngineVersion(root);
-  let failed = false;
-  const names = installedNames(options.packages, root, before, dependencyNames(root));
-  if (names.length === 0)
-    io.write(`
-mavonengine: couldn't tell which packages were installed. If one is a plugin, run 'mavonengine install <its name>' to register it
-`);
-  for (const name of names) {
-    let plugin;
-    try {
-      plugin = readPluginManifest(root, name);
-    } catch (err) {
-      io.write(`
-mavonengine: ${err.message}
-`);
-      failed = true;
-      continue;
-    }
-    if (!plugin) {
-      io.write(`
-${name} is installed. It is not a MavonEngine plugin (no "mavonengine" field in its package.json), so ${CONFIG_FILE} is left alone
-`);
-      continue;
-    }
-    io.write(`
-${describePlugin(plugin, engineVersion)}`);
-    const entry = config.plugins[name];
-    if (entry && entry.enabled !== false) {
-      io.write(`  Already in ${CONFIG_FILE}
-`);
-      continue;
-    }
-    if (!options.register)
-      continue;
-    if (!options.yes && !io.interactive) {
-      io.write(`  Not added to ${CONFIG_FILE}: run with --yes, or add "${name}": { "enabled": true } to its "plugins"
-`);
-      continue;
-    }
-    if (!options.yes && !await io.confirm(`Add ${name} to the plugins in ${CONFIG_FILE}? (Y/n) `)) {
-      io.write(`  Not added. Add "${name}": { "enabled": true } to "plugins" in ${CONFIG_FILE} to use it later
-`);
-      continue;
-    }
-    addPluginToConfig(root, name);
-    io.write(`  Added to ${join5(root, CONFIG_FILE)}
-`);
-    if (plugin.manifest.target !== "client")
-      io.write(`  Restart the game server ('mavonengine dev') to load it there
-`);
-  }
-  return failed ? 1 : 0;
-}
-
 // src/commands/mcp.ts
-import process8 from "process";
+import process9 from "process";
 import { parseArgs as parseArgs6 } from "util";
 
 // src/mcp/GameServerClient.ts
 var GameServerError = class extends Error {
 };
+var NET_UNAVAILABLE = "The network debug endpoints are not available: the game server runs with NODE_ENV=production (they are never served there), or it uses a @mavonengine/core release without them";
+function packetParams(query) {
+  return Object.fromEntries(Object.entries(query).filter(([, value]) => value !== void 0 && value !== "").map(([key, value]) => [key, String(value)]));
+}
 var DEV_UNAVAILABLE = "The dev endpoints are not available: the game server runs with NODE_ENV=production (they are never served there), or it uses a @mavonengine/core release without them";
 var GameServerClient = class {
   url;
@@ -2252,6 +3532,26 @@ var GameServerClient = class {
   entity(id) {
     return this.get(`api/game/dev/entities/${encodeURIComponent(id)}`, {}, DEV_UNAVAILABLE);
   }
+  /** The plugins of the project and whether each runs on the server */
+  plugins() {
+    return this.get("api/game/plugins", {}, "The game server doesn't list its plugins: it runs a @mavonengine/core release without GET /api/game/plugins, or its metrics endpoints are off");
+  }
+  /** Every HTTP endpoint of the server, with who registered it */
+  routes() {
+    return this.get("api/game/routes", {}, "The game server doesn't list its endpoints: it runs a @mavonengine/core release without GET /api/game/routes, or its metrics endpoints are off");
+  }
+  /** Packets and network events the server recorded, oldest first */
+  packets(query = {}) {
+    return this.get("api/game/dev/net/packets", packetParams(query), NET_UNAVAILABLE);
+  }
+  /** One recorded packet with its payload */
+  packet(id) {
+    return this.get(`api/game/dev/net/packets/${id}`, {}, NET_UNAVAILABLE);
+  }
+  /** Who is sent which entities */
+  sync() {
+    return this.get("api/game/dev/net/sync", {}, NET_UNAVAILABLE);
+  }
   /** The game tabs open in a browser, through the dev bridge */
   clients() {
     return this.bridge("__mavonengine/clients", {});
@@ -2321,9 +3621,10 @@ var MCP_HELP = `Usage: mavonengine mcp [options]
 Model Context Protocol (MCP) server over stdio, for any MCP client and model
 (Claude Code, Cursor, VS Code, Codex, Gemini CLI, Zed, local models, \u2026).
 It lets the assistant read a running game: the game server (status, metrics,
-players, scene, entities, logs, HTTP requests) and the game tabs open in a
-browser (renderer stats, entities, network, console, screenshots), and compare
-an entity on both sides. Every tool is read-only. Server scene and entity tools
+players, scene, entities, logs, HTTP requests, plugins) and the game tabs open
+in a browser (renderer stats, entities, network, console, screenshots), compare
+an entity on both sides, and see which official plugins the project could add.
+Every tool is read-only. Server scene and entity tools
 need the game server in development (NODE_ENV is not "production"); client
 tools need the client served by Vite in dev.
 
@@ -2339,13 +3640,18 @@ Options:
   --url <url>          Server base URL, e.g. http://localhost:8050, overrides --host and --port
   --client-url <url>   Where Vite serves the client in dev (default: the server URL,
                        which serves it in the template), e.g. http://localhost:5173
-  --token <token>      Metrics token (or set MAVONENGINE_METRICS_TOKEN)
+  --token <token>      Metrics or admin token (or set MAVONENGINE_METRICS_TOKEN
+                       or MAVONENGINE_ADMIN_TOKEN)
   --docs-url <url>     MCP server of the documentation for the docs_* tools
                        (default: https://mavonengine.com/mcp)
   --no-docs            Leave out the docs_* tools, e.g. offline
+  --plugins-url <url>  List of plugins that can be installed, for available_plugins and
+                       plugin_readme (default: plugins.json on the main branch of the
+                       MavonEngine repository, or MAVONENGINE_PLUGINS_URL)
+  --no-plugin-list     Leave out available_plugins and plugin_readme, e.g. offline
   -h, --help           Show this help
 `;
-function parseMcpArgs(args, env = process8.env) {
+function parseMcpArgs(args, env = process9.env) {
   const { values } = parseArgs6({
     args,
     options: {
@@ -2356,6 +3662,8 @@ function parseMcpArgs(args, env = process8.env) {
       "token": { type: "string" },
       "docs-url": { type: "string" },
       "docs": { type: "boolean", default: true },
+      "plugins-url": { type: "string" },
+      "plugin-list": { type: "boolean", default: true },
       "help": { type: "boolean", short: "h", default: false }
     },
     strict: true,
@@ -2372,7 +3680,7 @@ function parseMcpArgs(args, env = process8.env) {
     const host = values.host.includes(":") && !values.host.startsWith("[") ? `[${values.host}]` : values.host;
     url = `http://${host}:${port}`;
   }
-  for (const [flag, value] of [["--url", url], ["--client-url", values["client-url"]], ["--docs-url", values["docs-url"]]]) {
+  for (const [flag, value] of [["--url", url], ["--client-url", values["client-url"]], ["--docs-url", values["docs-url"]], ["--plugins-url", values["plugins-url"]]]) {
     try {
       if (value !== void 0)
         void new URL(value);
@@ -2381,25 +3689,26 @@ function parseMcpArgs(args, env = process8.env) {
     }
   }
   return {
-    client: new GameServerClient({ url, clientUrl: values["client-url"], token: values.token ?? env.MAVONENGINE_METRICS_TOKEN }),
-    docsUrl: values.docs ? values["docs-url"] ?? DEFAULT_DOCS_URL : false
+    client: new GameServerClient({ url, clientUrl: values["client-url"], token: values.token ?? env.MAVONENGINE_METRICS_TOKEN ?? env.MAVONENGINE_ADMIN_TOKEN }),
+    docsUrl: values.docs ? values["docs-url"] ?? DEFAULT_DOCS_URL : false,
+    pluginsUrl: values["plugin-list"] ? values["plugins-url"] ?? env[PLUGIN_REGISTRY_ENV] ?? PLUGIN_REGISTRY_URL : false
   };
 }
-async function runMcpCommand({ client, docsUrl }) {
+async function runMcpCommand({ client, docsUrl, pluginsUrl }) {
   const [{ StdioServerTransport }, { createMcpServer }, { DocsClient }] = await Promise.all([
     import("@modelcontextprotocol/sdk/server/stdio.js"),
-    import("./server-35RY6IGC.js"),
-    import("./docs-4C7X6FUQ.js")
+    import("./server-NNL4IMYV.js"),
+    import("./docs-O2V2WSUG.js")
   ]);
   const docs = docsUrl ? new DocsClient(docsUrl) : void 0;
-  const server = createMcpServer(client, docs);
+  const server = createMcpServer(client, docs, pluginsUrl ? { url: pluginsUrl } : void 0);
   const transport = new StdioServerTransport();
-  const closed = new Promise((resolve6) => {
-    transport.onclose = resolve6;
-    process8.stdin.on("end", resolve6);
+  const closed = new Promise((resolve7) => {
+    transport.onclose = resolve7;
+    process9.stdin.on("end", resolve7);
   });
   await server.connect(transport);
-  process8.stderr.write(`mavonengine mcp: reading the game server at ${client.url}
+  process9.stderr.write(`mavonengine mcp: reading the game server at ${client.url}
 `);
   await closed;
   await server.close().catch(() => {
@@ -2408,6 +3717,98 @@ async function runMcpCommand({ client, docsUrl }) {
   return 0;
 }
 
+// src/commands/plugins.ts
+import { resolve as resolve6 } from "path";
+import process10 from "process";
+import { parseArgs as parseArgs7 } from "util";
+var PLUGINS_HELP = `Usage: mavonengine plugins [options]
+
+List the plugins that are available to install. The list is plugins.json on the main branch
+of the MavonEngine repository, read from GitHub every time:
+  ${PLUGIN_REGISTRY_URL}
+
+Inside a project it also says which of them the project already has in ${CONFIG_FILE}.
+
+Options:
+  --url <url>        Read the list from here instead (also ${PLUGIN_REGISTRY_ENV})
+  --json             Print the list as JSON
+  --cwd <dir>        Look for the project here (default: current directory)
+  -h, --help         Show this help
+`;
+function parsePluginsArgs(args, cwd = process10.cwd(), env = process10.env) {
+  const { values, positionals } = parseArgs7({
+    args,
+    options: {
+      url: { type: "string" },
+      json: { type: "boolean", default: false },
+      cwd: { type: "string" },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    strict: true,
+    allowPositionals: true
+  });
+  if (values.help)
+    return "help";
+  if (positionals.length > 0)
+    throw new UsageError(`unexpected argument '${positionals[0]}'
+
+${PLUGINS_HELP}`);
+  return {
+    cwd: resolve6(cwd, values.cwd ?? "."),
+    url: values.url ?? env[PLUGIN_REGISTRY_ENV] ?? PLUGIN_REGISTRY_URL,
+    json: values.json
+  };
+}
+function projectPlugins(cwd) {
+  const states = /* @__PURE__ */ new Map();
+  const root = findConfigRoot(cwd);
+  if (!root)
+    return states;
+  try {
+    for (const [pkg, entry] of Object.entries(readConfig(root).plugins))
+      states.set(pkg, entry?.enabled === false ? "disabled" : "enabled");
+  } catch {
+  }
+  return states;
+}
+var TARGETS2 = { client: "client", server: "server", both: "client + server" };
+function formatPlugins(registry, inProject) {
+  const { plugins } = registry;
+  const lines = [`${plugins.length} plugin${plugins.length === 1 ? "" : "s"} available, from ${registry.url}`, ""];
+  if (registry.version > SUPPORTED_REGISTRY_VERSION)
+    lines.push("The list is in a newer format than this CLI knows, update @mavonengine/cli to see everything in it.", "");
+  const width = Math.max(0, ...plugins.map((plugin) => plugin.package.length));
+  for (const plugin of plugins) {
+    const state = inProject.get(plugin.package);
+    const facts = [
+      plugin.target ? `runs on ${TARGETS2[plugin.target]}` : void 0,
+      plugin.engine ? `@mavonengine/core ${plugin.engine}` : void 0,
+      state === "enabled" ? "in this project" : state === "disabled" ? "in this project, disabled" : void 0
+    ].filter(Boolean);
+    lines.push(`  ${plugin.package.padEnd(width)}  ${plugin.name === plugin.package ? "" : plugin.name}`.trimEnd());
+    if (plugin.description)
+      lines.push(`    ${plugin.description}`);
+    if (facts.length)
+      lines.push(`    ${facts.join(" \xB7 ")}`);
+    if (plugin.homepage)
+      lines.push(`    ${plugin.homepage}`);
+    lines.push("");
+  }
+  lines.push(plugins.length ? "Install one with: mavonengine install <package>" : "The list is empty.");
+  return `${lines.join("\n")}
+`;
+}
+async function runPluginsCommand(options, io = { write: (text) => process10.stdout.write(text) }) {
+  const registry = await fetchPluginRegistry({ url: options.url, fetch: io.fetch });
+  if (options.json) {
+    io.write(`${JSON.stringify(registry, null, 2)}
+`);
+    return 0;
+  }
+  io.write(formatPlugins(registry, projectPlugins(options.cwd)));
+  return 0;
+}
+
 // src/index.ts
 var HELP = `Usage: mavonengine <command> [options]
 
@@ -2416,6 +3817,7 @@ Commands:
   dashboard    Live terminal dashboard for a running game server
   dev          Run the project's dev servers (game server and client)
   install      Install packages and register engine plugins in mavonengine.json
+  plugins      List the plugins that are available to install
   build        Build the project for release, with the plugin assets it uses
   mcp          MCP server so AI assistants (any MCP client) can inspect a running game server
 
@@ -2428,18 +3830,18 @@ Run 'mavonengine <command> --help' for command options.
 async function main(argv) {
   const [command, ...args] = argv;
   if (!command || command === "-h" || command === "--help" || command === "help") {
-    process9.stdout.write(HELP);
+    process11.stdout.write(HELP);
     return 0;
   }
   if (command === "-v" || command === "--version") {
-    process9.stdout.write(`${version}
+    process11.stdout.write(`${version}
 `);
     return 0;
   }
   if (command === "create") {
     const options = parseCreateArgs(args);
     if (options === "help") {
-      process9.stdout.write(CREATE_HELP);
+      process11.stdout.write(CREATE_HELP);
       return 0;
     }
     return runCreateCommand(options);
@@ -2447,11 +3849,11 @@ async function main(argv) {
   if (command === "dashboard") {
     const options = parseDashboardArgs(args);
     if (options === "help") {
-      process9.stdout.write(DASHBOARD_HELP);
+      process11.stdout.write(DASHBOARD_HELP);
       return 0;
     }
-    if (!process9.stdout.isTTY || !process9.stdin.isTTY) {
-      process9.stderr.write("mavonengine dashboard needs an interactive terminal\n");
+    if (!process11.stdout.isTTY || !process11.stdin.isTTY) {
+      process11.stderr.write("mavonengine dashboard needs an interactive terminal\n");
       return 1;
     }
     await runDashboard(options);
@@ -2460,7 +3862,7 @@ async function main(argv) {
   if (command === "dev") {
     const options = parseDevArgs(args);
     if (options === "help") {
-      process9.stdout.write(DEV_HELP);
+      process11.stdout.write(DEV_HELP);
       return 0;
     }
     return runDevCommand(options);
@@ -2468,15 +3870,23 @@ async function main(argv) {
   if (command === "install" || command === "i" || command === "add") {
     const options = parseInstallArgs(args);
     if (options === "help") {
-      process9.stdout.write(INSTALL_HELP);
+      process11.stdout.write(INSTALL_HELP);
       return 0;
     }
     return runInstallCommand(options);
   }
+  if (command === "plugins") {
+    const options = parsePluginsArgs(args);
+    if (options === "help") {
+      process11.stdout.write(PLUGINS_HELP);
+      return 0;
+    }
+    return runPluginsCommand(options);
+  }
   if (command === "mcp") {
     const options = parseMcpArgs(args);
     if (options === "help") {
-      process9.stdout.write(MCP_HELP);
+      process11.stdout.write(MCP_HELP);
       return 0;
     }
     return runMcpCommand(options);
@@ -2484,7 +3894,7 @@ async function main(argv) {
   if (command === "build") {
     const options = parseBuildArgs(args);
     if (options === "help") {
-      process9.stdout.write(BUILD_HELP);
+      process11.stdout.write(BUILD_HELP);
       return 0;
     }
     return runBuildCommand(options);
@@ -2493,9 +3903,9 @@ async function main(argv) {
 
 ${HELP}`);
 }
-main(process9.argv.slice(2)).then((code) => process9.exit(code)).catch((err) => {
+main(process11.argv.slice(2)).then((code) => process11.exit(code)).catch((err) => {
   const isUsage = err instanceof UsageError || err.code?.startsWith("ERR_PARSE_ARGS");
-  process9.stderr.write(`mavonengine: ${err.message}
+  process11.stderr.write(`mavonengine: ${err.message}
 `);
-  process9.exit(isUsage ? 2 : 1);
+  process11.exit(isUsage ? 2 : 1);
 });