@wumx-labs/noxaeapi-sdk 0.1.0 → 0.1.1

package/dist/index.d.cts

@@ -33,6 +33,16 @@ declare class HttpEngine {
     request<T>(method: "GET" | "POST" | "PUT" | "DELETE" | "PATCH", path: string, opts?: {
         body?: unknown;
         query?: Record<string, QueryValue>;
+        /**
+         * Encode `body` as `application/x-www-form-urlencoded` (Javalin's
+         * `ctx.formParam(...)`) instead of JSON. Most NoxAeApi endpoints
+         * expect form-urlencoded bodies — only the LuckPerms and NoxAuth
+         * routes use `ctx.bodyAsClass(...)` and need real JSON. Defaults to
+         * `false` (JSON) to preserve existing behavior; each module call
+         * site is responsible for passing `form: true` where the server
+         * actually expects it.
+         */
+        form?: boolean;
     }): Promise<T>;
 }
 
@@ -205,8 +215,11 @@ declare class PlayersModule {
     getInventory(playerUuid: string, worldUuid: string): Promise<InventoryItem[]>;
     /** Kick an online player, optionally with a reason. */
     kick(uuid: string, reason?: string): Promise<void>;
-    /** Ban a player, optionally with a reason and expiration. */
-    ban(uuid: string, reason?: string): Promise<void>;
+    /**
+     * Ban a player, optionally with a reason and an ISO-8601 expiry
+     * (e.g. "2030-01-01T00:00:00Z"). Omit `expiry` for a permanent ban.
+     */
+    ban(uuid: string, reason?: string, expiry?: string): Promise<void>;
     /** Remove a player's ban. */
     unban(uuid: string): Promise<void>;
     /** Teleport a player to a location. */
@@ -247,23 +260,40 @@ declare class ServerModule {
     /** Get server info: version, MOTD, TPS, health, player counts, etc. */
     info(): Promise<ServerInfo>;
     /**
-     * Run a console command on the server.
+     * Run a console command on the server, returning its console output.
      * This is a privileged endpoint — requires a write-enabled API key.
+     *
+     * `waitMs` is how long to wait for output before returning (server
+     * default 500ms if omitted). The server returns the joined output as a
+     * plain JSON string, not `{ lines }`.
      */
-    exec(command: string): Promise<{
-        lines: string[];
-    }>;
+    exec(command: string, waitMs?: number): Promise<string>;
     /** List server operators. */
     getOps(): Promise<WhitelistEntry[]>;
-    /** Grant operator status to a player. */
+    /**
+     * Grant operator status to a player.
+     *
+     * Server-side (`ServerApi.opPlayer`) reads `ctx.formParam("playerUuid")`,
+     * not "uuid" — the field name matters here.
+     */
     opPlayer(uuid: string): Promise<void>;
-    /** Revoke operator status from a player. */
+    /**
+     * Revoke operator status from a player.
+     *
+     * Server-side (`ServerApi.deopPlayer`) reads this from the query string
+     * (`ctx.queryParam("playerUuid")`), not the request body.
+     */
     deopPlayer(uuid: string): Promise<void>;
     /** Get the current whitelist. */
     getWhitelist(): Promise<WhitelistEntry[]>;
     /** Add a player to the whitelist. */
     addToWhitelist(uuid: string, name?: string): Promise<void>;
-    /** Remove a player from the whitelist. */
+    /**
+     * Remove a player from the whitelist.
+     *
+     * Server-side (`ServerApi.whitelistDelete`) reads `uuid`/`name` from the
+     * query string, not the request body.
+     */
     removeFromWhitelist(uuid: string): Promise<void>;
     /**
      * Restart the server.
@@ -293,11 +323,21 @@ declare class ServerModule {
     getScoreboard(): Promise<unknown>;
     /** Set a score for an entry on an objective. */
     setScore(objective: string, entry: string, value: number): Promise<void>;
-    /** Reset (remove) a score for an entry on an objective. */
+    /**
+     * Reset (remove) a score for an entry on an objective.
+     *
+     * Server-side (`ServerApi.resetScore`) reads `entry` from the query
+     * string, not the request body.
+     */
     resetScore(objective: string, entry: string): Promise<void>;
     /** Broadcast a message to every player on the server. */
     broadcast(message: string): Promise<void>;
-    /** Send a private message to a specific player. */
+    /**
+     * Send a private message to a specific player.
+     *
+     * Server-side (`ServerApi.tellPost`) reads `ctx.formParam("playerUuid")`,
+     * not "uuid".
+     */
     tell(uuid: string, message: string): Promise<void>;
 }
 
@@ -320,13 +360,16 @@ declare class WorldsModule {
     download(uuid: string): Promise<{
         url: string;
     }>;
-    /** Set the in-game time for a world. */
+    /** Set the in-game time for a world (0-24000). */
     setTime(uuid: string, time: number): Promise<void>;
-    /** Set weather (storm/thundering) for a world. */
-    setWeather(uuid: string, weather: {
-        storm?: boolean;
-        thundering?: boolean;
-    }): Promise<void>;
+    /**
+     * Set the weather for a world.
+     *
+     * Server-side (`WorldApi.setWorldWeather`) reads a single
+     * `ctx.formParam("weather")` enum string — "clear" | "rain" | "thunder" —
+     * not separate storm/thundering booleans.
+     */
+    setWeather(uuid: string, weather: "clear" | "rain" | "thunder"): Promise<void>;
     /** Get entity counts within a specific world. */
     getEntities(uuid: string): Promise<{
         world: string;
@@ -341,10 +384,14 @@ declare class PluginsModule {
     /** List all installed plugins/mods. */
     list(): Promise<Plugin[]>;
     /**
-     * Install a plugin from a URL or identifier.
+     * Install a plugin by downloading it from a direct URL.
      * This is a privileged endpoint — requires a write-enabled API key.
+     *
+     * Server-side (`PluginApi.installPlugin`) reads
+     * `ctx.formParam("downloadUrl")`, not "source", and the request must be
+     * form-urlencoded.
      */
-    install(source: string): Promise<void>;
+    install(downloadUrl: string): Promise<void>;
     /** Enable a plugin by name. */
     enable(name: string): Promise<void>;
     /** Disable a plugin by name. */
@@ -361,12 +408,15 @@ declare class PlaceholdersModule {
     private readonly http;
     constructor(http: HttpEngine);
     /**
-     * Replace PlaceholderAPI-style placeholders (e.g. "%player_name%") for a
-     * player, returning the resolved string.
+     * Replace PlaceholderAPI-style placeholders (e.g. "%player_name%") in
+     * `message` for a player, returning the resolved string.
+     *
+     * Server-side this is `PAPIApi.replacePlaceholders`, which reads
+     * `ctx.formParam("message")` and `ctx.formParam("uuid")` — the field is
+     * literally named "message", not "text", and the whole body must be
+     * form-urlencoded.
      */
-    replace(uuid: string, text: string): Promise<{
-        result: string;
-    }>;
+    replace(uuid: string, message: string): Promise<string>;
 }
 
 /**
@@ -375,6 +425,10 @@ declare class PlaceholdersModule {
  * without it will fail (typically a 404). There's no separate "is this
  * available" flag from the SDK's side; check `client.plugins.list()` for
  * LuckPerms if you need to branch on it ahead of time.
+ *
+ * Unlike most other modules, these POST/DELETE bodies are sent as real
+ * JSON (the server reads them with `ctx.bodyAsClass(...)`, not
+ * `ctx.formParam(...)`) — do not add `form: true` to these calls.
  */
 declare class LuckPermsModule {
     private readonly http;
@@ -406,6 +460,10 @@ declare class LuckPermsModule {
  * Wraps the `/v1/noxauth/*` routes. These only work when `noxauth.enabled`
  * is set to true in the server's noxaeapi-config.yml and the NoxAuth plugin
  * is installed.
+ *
+ * `checkPassword`'s body is sent as real JSON (the server parses it with
+ * `GsonSingleton...fromJson(ctx.body(), PasswordCheckRequest.class)`, not
+ * `ctx.formParam(...)`) — do not add `form: true` to that call.
  */
 declare class NoxAuthModule {
     private readonly http;

package/dist/index.d.ts

@@ -33,6 +33,16 @@ declare class HttpEngine {
     request<T>(method: "GET" | "POST" | "PUT" | "DELETE" | "PATCH", path: string, opts?: {
         body?: unknown;
         query?: Record<string, QueryValue>;
+        /**
+         * Encode `body` as `application/x-www-form-urlencoded` (Javalin's
+         * `ctx.formParam(...)`) instead of JSON. Most NoxAeApi endpoints
+         * expect form-urlencoded bodies — only the LuckPerms and NoxAuth
+         * routes use `ctx.bodyAsClass(...)` and need real JSON. Defaults to
+         * `false` (JSON) to preserve existing behavior; each module call
+         * site is responsible for passing `form: true` where the server
+         * actually expects it.
+         */
+        form?: boolean;
     }): Promise<T>;
 }
 
@@ -205,8 +215,11 @@ declare class PlayersModule {
     getInventory(playerUuid: string, worldUuid: string): Promise<InventoryItem[]>;
     /** Kick an online player, optionally with a reason. */
     kick(uuid: string, reason?: string): Promise<void>;
-    /** Ban a player, optionally with a reason and expiration. */
-    ban(uuid: string, reason?: string): Promise<void>;
+    /**
+     * Ban a player, optionally with a reason and an ISO-8601 expiry
+     * (e.g. "2030-01-01T00:00:00Z"). Omit `expiry` for a permanent ban.
+     */
+    ban(uuid: string, reason?: string, expiry?: string): Promise<void>;
     /** Remove a player's ban. */
     unban(uuid: string): Promise<void>;
     /** Teleport a player to a location. */
@@ -247,23 +260,40 @@ declare class ServerModule {
     /** Get server info: version, MOTD, TPS, health, player counts, etc. */
     info(): Promise<ServerInfo>;
     /**
-     * Run a console command on the server.
+     * Run a console command on the server, returning its console output.
      * This is a privileged endpoint — requires a write-enabled API key.
+     *
+     * `waitMs` is how long to wait for output before returning (server
+     * default 500ms if omitted). The server returns the joined output as a
+     * plain JSON string, not `{ lines }`.
      */
-    exec(command: string): Promise<{
-        lines: string[];
-    }>;
+    exec(command: string, waitMs?: number): Promise<string>;
     /** List server operators. */
     getOps(): Promise<WhitelistEntry[]>;
-    /** Grant operator status to a player. */
+    /**
+     * Grant operator status to a player.
+     *
+     * Server-side (`ServerApi.opPlayer`) reads `ctx.formParam("playerUuid")`,
+     * not "uuid" — the field name matters here.
+     */
     opPlayer(uuid: string): Promise<void>;
-    /** Revoke operator status from a player. */
+    /**
+     * Revoke operator status from a player.
+     *
+     * Server-side (`ServerApi.deopPlayer`) reads this from the query string
+     * (`ctx.queryParam("playerUuid")`), not the request body.
+     */
     deopPlayer(uuid: string): Promise<void>;
     /** Get the current whitelist. */
     getWhitelist(): Promise<WhitelistEntry[]>;
     /** Add a player to the whitelist. */
     addToWhitelist(uuid: string, name?: string): Promise<void>;
-    /** Remove a player from the whitelist. */
+    /**
+     * Remove a player from the whitelist.
+     *
+     * Server-side (`ServerApi.whitelistDelete`) reads `uuid`/`name` from the
+     * query string, not the request body.
+     */
     removeFromWhitelist(uuid: string): Promise<void>;
     /**
      * Restart the server.
@@ -293,11 +323,21 @@ declare class ServerModule {
     getScoreboard(): Promise<unknown>;
     /** Set a score for an entry on an objective. */
     setScore(objective: string, entry: string, value: number): Promise<void>;
-    /** Reset (remove) a score for an entry on an objective. */
+    /**
+     * Reset (remove) a score for an entry on an objective.
+     *
+     * Server-side (`ServerApi.resetScore`) reads `entry` from the query
+     * string, not the request body.
+     */
     resetScore(objective: string, entry: string): Promise<void>;
     /** Broadcast a message to every player on the server. */
     broadcast(message: string): Promise<void>;
-    /** Send a private message to a specific player. */
+    /**
+     * Send a private message to a specific player.
+     *
+     * Server-side (`ServerApi.tellPost`) reads `ctx.formParam("playerUuid")`,
+     * not "uuid".
+     */
     tell(uuid: string, message: string): Promise<void>;
 }
 
@@ -320,13 +360,16 @@ declare class WorldsModule {
     download(uuid: string): Promise<{
         url: string;
     }>;
-    /** Set the in-game time for a world. */
+    /** Set the in-game time for a world (0-24000). */
     setTime(uuid: string, time: number): Promise<void>;
-    /** Set weather (storm/thundering) for a world. */
-    setWeather(uuid: string, weather: {
-        storm?: boolean;
-        thundering?: boolean;
-    }): Promise<void>;
+    /**
+     * Set the weather for a world.
+     *
+     * Server-side (`WorldApi.setWorldWeather`) reads a single
+     * `ctx.formParam("weather")` enum string — "clear" | "rain" | "thunder" —
+     * not separate storm/thundering booleans.
+     */
+    setWeather(uuid: string, weather: "clear" | "rain" | "thunder"): Promise<void>;
     /** Get entity counts within a specific world. */
     getEntities(uuid: string): Promise<{
         world: string;
@@ -341,10 +384,14 @@ declare class PluginsModule {
     /** List all installed plugins/mods. */
     list(): Promise<Plugin[]>;
     /**
-     * Install a plugin from a URL or identifier.
+     * Install a plugin by downloading it from a direct URL.
      * This is a privileged endpoint — requires a write-enabled API key.
+     *
+     * Server-side (`PluginApi.installPlugin`) reads
+     * `ctx.formParam("downloadUrl")`, not "source", and the request must be
+     * form-urlencoded.
      */
-    install(source: string): Promise<void>;
+    install(downloadUrl: string): Promise<void>;
     /** Enable a plugin by name. */
     enable(name: string): Promise<void>;
     /** Disable a plugin by name. */
@@ -361,12 +408,15 @@ declare class PlaceholdersModule {
     private readonly http;
     constructor(http: HttpEngine);
     /**
-     * Replace PlaceholderAPI-style placeholders (e.g. "%player_name%") for a
-     * player, returning the resolved string.
+     * Replace PlaceholderAPI-style placeholders (e.g. "%player_name%") in
+     * `message` for a player, returning the resolved string.
+     *
+     * Server-side this is `PAPIApi.replacePlaceholders`, which reads
+     * `ctx.formParam("message")` and `ctx.formParam("uuid")` — the field is
+     * literally named "message", not "text", and the whole body must be
+     * form-urlencoded.
      */
-    replace(uuid: string, text: string): Promise<{
-        result: string;
-    }>;
+    replace(uuid: string, message: string): Promise<string>;
 }
 
 /**
@@ -375,6 +425,10 @@ declare class PlaceholdersModule {
  * without it will fail (typically a 404). There's no separate "is this
  * available" flag from the SDK's side; check `client.plugins.list()` for
  * LuckPerms if you need to branch on it ahead of time.
+ *
+ * Unlike most other modules, these POST/DELETE bodies are sent as real
+ * JSON (the server reads them with `ctx.bodyAsClass(...)`, not
+ * `ctx.formParam(...)`) — do not add `form: true` to these calls.
  */
 declare class LuckPermsModule {
     private readonly http;
@@ -406,6 +460,10 @@ declare class LuckPermsModule {
  * Wraps the `/v1/noxauth/*` routes. These only work when `noxauth.enabled`
  * is set to true in the server's noxaeapi-config.yml and the NoxAuth plugin
  * is installed.
+ *
+ * `checkPassword`'s body is sent as real JSON (the server parses it with
+ * `GsonSingleton...fromJson(ctx.body(), PasswordCheckRequest.class)`, not
+ * `ctx.formParam(...)`) — do not add `form: true` to that call.
  */
 declare class NoxAuthModule {
     private readonly http;

package/dist/index.js

@@ -105,7 +105,7 @@ var HttpEngine = class {
     this.fetchImpl = fetchImpl;
   }
   buildUrl(path, query) {
-    const url = new URL(`${this.baseUrl}/${path.replace(/^\/+/, "")}`);
+    const url = new URL(`${this.baseUrl}/v1/${path.replace(/^\/+/, "")}`);
     if (query) {
       for (const [key, value] of Object.entries(query)) {
         if (value !== void 0 && value !== null) {
@@ -128,11 +128,20 @@ var HttpEngine = class {
           ...this.extraHeaders
         };
         if (this.apiKey) headers["key"] = this.apiKey;
-        if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+        let encodedBody;
+        if (opts.body !== void 0) {
+          if (opts.form) {
+            headers["Content-Type"] = "application/x-www-form-urlencoded";
+            encodedBody = encodeFormBody(opts.body);
+          } else {
+            headers["Content-Type"] = "application/json";
+            encodedBody = JSON.stringify(opts.body);
+          }
+        }
         const response = await this.fetchImpl(url, {
           method,
           headers,
-          body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+          body: encodedBody,
           signal: controller.signal
         });
         clearTimeout(timeout);
@@ -192,6 +201,19 @@ var HttpEngine = class {
     throw lastError instanceof Error ? lastError : new Error("Request failed after retries");
   }
 };
+function encodeFormBody(body) {
+  const params = new URLSearchParams();
+  if (body && typeof body === "object") {
+    for (const [key, value] of Object.entries(body)) {
+      if (value === void 0 || value === null) continue;
+      params.set(
+        key,
+        typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? String(value) : JSON.stringify(value)
+      );
+    }
+  }
+  return params.toString();
+}
 function safeJsonParse(text) {
   if (!text) return void 0;
   try {
@@ -236,13 +258,18 @@ var PlayersModule = class {
   /** Kick an online player, optionally with a reason. */
   kick(uuid, reason) {
     return this.http.request("POST", `players/${encodeURIComponent(uuid)}/kick`, {
-      body: reason ? { reason } : void 0
+      body: reason ? { reason } : void 0,
+      form: true
     });
   }
-  /** Ban a player, optionally with a reason and expiration. */
-  ban(uuid, reason) {
+  /**
+   * Ban a player, optionally with a reason and an ISO-8601 expiry
+   * (e.g. "2030-01-01T00:00:00Z"). Omit `expiry` for a permanent ban.
+   */
+  ban(uuid, reason, expiry) {
     return this.http.request("POST", `players/${encodeURIComponent(uuid)}/ban`, {
-      body: reason ? { reason } : void 0
+      body: reason || expiry ? { reason, expiry } : void 0,
+      form: true
     });
   }
   /** Remove a player's ban. */
@@ -252,13 +279,15 @@ var PlayersModule = class {
   /** Teleport a player to a location. */
   teleport(uuid, location) {
     return this.http.request("POST", `players/${encodeURIComponent(uuid)}/teleport`, {
-      body: location
+      body: location,
+      form: true
     });
   }
   /** Change a player's gamemode. */
   setGamemode(uuid, gamemode) {
     return this.http.request("PUT", `players/${encodeURIComponent(uuid)}/gamemode`, {
-      body: { gamemode }
+      body: { gamemode },
+      form: true
     });
   }
   /** Get kill/death/playtime/block stats for a player. */
@@ -289,11 +318,11 @@ var EconomyModule = class {
   }
   /** Pay an amount to a player (adds to their balance). */
   pay(uuid, amount) {
-    return this.http.request("POST", "economy/pay", { body: { uuid, amount } });
+    return this.http.request("POST", "economy/pay", { body: { uuid, amount }, form: true });
   }
   /** Debit an amount from a player (subtracts from their balance). */
   debit(uuid, amount) {
-    return this.http.request("POST", "economy/debit", { body: { uuid, amount } });
+    return this.http.request("POST", "economy/debit", { body: { uuid, amount }, form: true });
   }
 };
 
@@ -312,23 +341,40 @@ var ServerModule = class {
     return this.http.request("GET", "server");
   }
   /**
-   * Run a console command on the server.
+   * Run a console command on the server, returning its console output.
    * This is a privileged endpoint — requires a write-enabled API key.
+   *
+   * `waitMs` is how long to wait for output before returning (server
+   * default 500ms if omitted). The server returns the joined output as a
+   * plain JSON string, not `{ lines }`.
    */
-  exec(command) {
-    return this.http.request("POST", "server/exec", { body: { command } });
+  exec(command, waitMs) {
+    return this.http.request("POST", "server/exec", {
+      body: { command, time: waitMs },
+      form: true
+    });
   }
   /** List server operators. */
   getOps() {
     return this.http.request("GET", "server/ops");
   }
-  /** Grant operator status to a player. */
+  /**
+   * Grant operator status to a player.
+   *
+   * Server-side (`ServerApi.opPlayer`) reads `ctx.formParam("playerUuid")`,
+   * not "uuid" — the field name matters here.
+   */
   opPlayer(uuid) {
-    return this.http.request("POST", "server/ops", { body: { uuid } });
+    return this.http.request("POST", "server/ops", { body: { playerUuid: uuid }, form: true });
   }
-  /** Revoke operator status from a player. */
+  /**
+   * Revoke operator status from a player.
+   *
+   * Server-side (`ServerApi.deopPlayer`) reads this from the query string
+   * (`ctx.queryParam("playerUuid")`), not the request body.
+   */
   deopPlayer(uuid) {
-    return this.http.request("DELETE", "server/ops", { body: { uuid } });
+    return this.http.request("DELETE", "server/ops", { query: { playerUuid: uuid } });
   }
   /** Get the current whitelist. */
   getWhitelist() {
@@ -336,11 +382,16 @@ var ServerModule = class {
   }
   /** Add a player to the whitelist. */
   addToWhitelist(uuid, name) {
-    return this.http.request("POST", "server/whitelist", { body: { uuid, name } });
+    return this.http.request("POST", "server/whitelist", { body: { uuid, name }, form: true });
   }
-  /** Remove a player from the whitelist. */
+  /**
+   * Remove a player from the whitelist.
+   *
+   * Server-side (`ServerApi.whitelistDelete`) reads `uuid`/`name` from the
+   * query string, not the request body.
+   */
   removeFromWhitelist(uuid) {
-    return this.http.request("DELETE", "server/whitelist", { body: { uuid } });
+    return this.http.request("DELETE", "server/whitelist", { query: { uuid } });
   }
   /**
    * Restart the server.
@@ -363,7 +414,7 @@ var ServerModule = class {
   }
   /** Ban an IP address. */
   banIp(ip, reason) {
-    return this.http.request("POST", "server/ban-ip", { body: { ip, reason } });
+    return this.http.request("POST", "server/ban-ip", { body: { ip, reason }, form: true });
   }
   /** Get a scoreboard objective's scores by objective name. */
   getObjective(name) {
@@ -376,22 +427,33 @@ var ServerModule = class {
   /** Set a score for an entry on an objective. */
   setScore(objective, entry, value) {
     return this.http.request("POST", `scoreboard/${encodeURIComponent(objective)}/score`, {
-      body: { entry, value }
+      body: { entry, value },
+      form: true
     });
   }
-  /** Reset (remove) a score for an entry on an objective. */
+  /**
+   * Reset (remove) a score for an entry on an objective.
+   *
+   * Server-side (`ServerApi.resetScore`) reads `entry` from the query
+   * string, not the request body.
+   */
   resetScore(objective, entry) {
     return this.http.request("DELETE", `scoreboard/${encodeURIComponent(objective)}/score`, {
-      body: { entry }
+      query: { entry }
     });
   }
   /** Broadcast a message to every player on the server. */
   broadcast(message) {
-    return this.http.request("POST", "chat/broadcast", { body: { message } });
+    return this.http.request("POST", "chat/broadcast", { body: { message }, form: true });
   }
-  /** Send a private message to a specific player. */
+  /**
+   * Send a private message to a specific player.
+   *
+   * Server-side (`ServerApi.tellPost`) reads `ctx.formParam("playerUuid")`,
+   * not "uuid".
+   */
   tell(uuid, message) {
-    return this.http.request("POST", "chat/tell", { body: { uuid, message } });
+    return this.http.request("POST", "chat/tell", { body: { playerUuid: uuid, message }, form: true });
   }
 };
 
@@ -425,16 +487,24 @@ var WorldsModule = class {
   download(uuid) {
     return this.http.request("GET", `worlds/${encodeURIComponent(uuid)}/download`);
   }
-  /** Set the in-game time for a world. */
+  /** Set the in-game time for a world (0-24000). */
   setTime(uuid, time) {
     return this.http.request("POST", `worlds/${encodeURIComponent(uuid)}/time`, {
-      body: { time }
+      body: { time },
+      form: true
     });
   }
-  /** Set weather (storm/thundering) for a world. */
+  /**
+   * Set the weather for a world.
+   *
+   * Server-side (`WorldApi.setWorldWeather`) reads a single
+   * `ctx.formParam("weather")` enum string — "clear" | "rain" | "thunder" —
+   * not separate storm/thundering booleans.
+   */
   setWeather(uuid, weather) {
     return this.http.request("POST", `worlds/${encodeURIComponent(uuid)}/weather`, {
-      body: weather
+      body: { weather },
+      form: true
     });
   }
   /** Get entity counts within a specific world. */
@@ -454,11 +524,15 @@ var PluginsModule = class {
     return this.http.request("GET", "plugins");
   }
   /**
-   * Install a plugin from a URL or identifier.
+   * Install a plugin by downloading it from a direct URL.
    * This is a privileged endpoint — requires a write-enabled API key.
+   *
+   * Server-side (`PluginApi.installPlugin`) reads
+   * `ctx.formParam("downloadUrl")`, not "source", and the request must be
+   * form-urlencoded.
    */
-  install(source) {
-    return this.http.request("POST", "plugins", { body: { source } });
+  install(downloadUrl) {
+    return this.http.request("POST", "plugins", { body: { downloadUrl }, form: true });
   }
   /** Enable a plugin by name. */
   enable(name) {
@@ -487,12 +561,18 @@ var PlaceholdersModule = class {
   }
   http;
   /**
-   * Replace PlaceholderAPI-style placeholders (e.g. "%player_name%") for a
-   * player, returning the resolved string.
+   * Replace PlaceholderAPI-style placeholders (e.g. "%player_name%") in
+   * `message` for a player, returning the resolved string.
+   *
+   * Server-side this is `PAPIApi.replacePlaceholders`, which reads
+   * `ctx.formParam("message")` and `ctx.formParam("uuid")` — the field is
+   * literally named "message", not "text", and the whole body must be
+   * form-urlencoded.
    */
-  replace(uuid, text) {
+  replace(uuid, message) {
     return this.http.request("POST", "placeholders/replace", {
-      body: { uuid, text }
+      body: { uuid, message },
+      form: true
     });
   }
 };
@@ -585,7 +665,7 @@ var NoxAuthModule = class {
 
 // src/socket.ts
 function toWsUrl(baseUrl, route, apiKey) {
-  const url = new URL(`${baseUrl.replace(/\/+$/, "")}/${route.replace(/^\/+/, "")}`);
+  const url = new URL(`${baseUrl.replace(/\/+$/, "")}/v1/ws/${route.replace(/^\/+/, "")}`);
   url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
   if (apiKey) url.searchParams.set("key", apiKey);
   return url.toString();