@s2script/sdk 0.25.0 → 0.26.0

package/dist/cli.js

@@ -2076,7 +2076,7 @@ var require_semver2 = __commonJS({
 });
 
 // src/commands/build.ts
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 
 // src/build.ts
 import * as esbuild2 from "esbuild";
@@ -3068,34 +3068,675 @@ function unzipSync(data, opts) {
 }
 
 // src/build.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, rmSync as rmSync2 } from "node:fs";
-import { resolve as resolve10, join as join11, sep as sep2, basename } from "node:path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, rmSync as rmSync2 } from "node:fs";
+import { resolve as resolve11, join as join11, sep as sep2, basename } from "node:path";
 
 // src/typecheck/typecheck.ts
+import ts3 from "typescript";
+
+// src/interop.ts
+import ts2 from "typescript";
+import { createHash } from "node:crypto";
+
+// src/publish-scan.ts
 import ts from "typescript";
-import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync6, writeFileSync, rmSync, mkdtempSync } from "node:fs";
-import { join as join7, resolve as resolve6 } from "node:path";
+function pluginApiName(checker, call) {
+  const declaration = checker.getResolvedSignature(call)?.getDeclaration();
+  if (!declaration || !declaration.getSourceFile().fileName.replace(/\\/g, "/").endsWith("/sdk/plugin.d.ts"))
+    return void 0;
+  const name = declaration.name;
+  return name && (ts.isIdentifier(name) || ts.isStringLiteral(name)) ? name.text : void 0;
+}
+function recordPublishOrUse(out, method, arg0, sf, node) {
+  if (method === "publish") {
+    if (arg0 !== void 0 && ts.isStringLiteralLike(arg0)) {
+      out.publishNames.push(arg0.text);
+    } else {
+      const { line } = sf.getLineAndCharacterOfPosition(node.getStart());
+      out.dynamicPublishSites.push(`${sf.fileName}:${line + 1}`);
+    }
+  } else if (arg0 !== void 0 && ts.isStringLiteralLike(arg0)) {
+    out.useNames.push(arg0.text);
+  }
+}
+function recordImportSpecifier(out, spec) {
+  if (spec.startsWith(".") || spec.startsWith("@s2script/")) return;
+  out.importNames.push(spec);
+}
+function scanPluginProgram(program, pluginDir) {
+  const checker = program.getTypeChecker();
+  const out = {
+    publishNames: [],
+    dynamicPublishSites: [],
+    useNames: [],
+    importNames: []
+  };
+  const dirPrefix = pluginDir.replace(/\\/g, "/").replace(/\/+$/, "") + "/";
+  for (const sf of program.getSourceFiles()) {
+    if (sf.isDeclarationFile) continue;
+    if (!sf.fileName.replace(/\\/g, "/").startsWith(dirPrefix)) continue;
+    const visit = (node) => {
+      if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier !== void 0 && ts.isStringLiteralLike(node.moduleSpecifier)) {
+        recordImportSpecifier(out, node.moduleSpecifier.text);
+      }
+      if (ts.isCallExpression(node)) {
+        const name = pluginApiName(checker, node);
+        if (name && [
+          "publish",
+          "use",
+          "tryUse",
+          "watchOptional",
+          "bindForwards"
+        ].includes(name))
+          recordPublishOrUse(out, name, node.arguments[0], sf, node);
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(sf);
+  }
+  out.publishNames = [...new Set(out.publishNames)];
+  out.useNames = [...new Set(out.useNames)];
+  out.importNames = [...new Set(out.importNames)];
+  return out;
+}
+
+// src/interop.ts
+import { resolve } from "node:path";
+
+// src/tsconfig-shared.ts
+var sharedCompilerOptionsJson = {
+  strict: true,
+  noEmit: true,
+  moduleResolution: "bundler",
+  module: "ESNext",
+  target: "ES2024",
+  lib: ["ES2024"],
+  types: [],
+  skipLibCheck: true,
+  allowImportingTsExtensions: true
+};
+function sharedProgramOptions(tsMod) {
+  return {
+    strict: sharedCompilerOptionsJson.strict,
+    noEmit: sharedCompilerOptionsJson.noEmit,
+    allowImportingTsExtensions: sharedCompilerOptionsJson.allowImportingTsExtensions,
+    moduleResolution: tsMod.ModuleResolutionKind.Bundler,
+    module: tsMod.ModuleKind.ESNext,
+    target: tsMod.ScriptTarget.ES2024,
+    lib: sharedCompilerOptionsJson.lib.map((l2) => `lib.${l2.toLowerCase()}.d.ts`),
+    types: [...sharedCompilerOptionsJson.types],
+    skipLibCheck: sharedCompilerOptionsJson.skipLibCheck
+  };
+}
+
+// src/interop.ts
+function canonical(value) {
+  if (typeof value === "string") {
+    if (/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(
+      value
+    ))
+      throw new Error(
+        "canonical metadata requires well-formed Unicode strings"
+      );
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number" && !Number.isFinite(value))
+    throw new Error("canonical metadata requires finite numbers");
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.keys(value).sort().map(
+      (k) => `${canonical(k)}:${canonical(value[k])}`
+    ).join(",")}}`;
+  if (value === null || typeof value === "boolean" || typeof value === "number")
+    return JSON.stringify(value);
+  throw new Error("canonical metadata requires JSON values");
+}
+function extractContract(path, packagesDir) {
+  const program = ts2.createProgram([path], {
+    ...sharedProgramOptions(ts2),
+    skipLibCheck: false,
+    baseUrl: packagesDir,
+    paths: { "@s2script/sdk": ["sdk/index.d.ts"], "@s2script/sdk/*": ["sdk/*.d.ts"] }
+  });
+  const checker = program.getTypeChecker();
+  const sf = program.getSourceFile(path);
+  const fail = (node, reason) => {
+    const pos = sf.getLineAndCharacterOfPosition(node.getStart(sf));
+    throw new Error(
+      `${path}:${pos.line + 1}:${pos.character + 1}: InterfaceContractError: ${reason}`
+    );
+  };
+  const visitImports = (node) => {
+    if (ts2.isImportDeclaration(node)) {
+      const module2 = ts2.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : "";
+      const bindings = node.importClause?.namedBindings;
+      const allowed = module2 === "@s2script/sdk/interfaces" ? ["Notification", "Hook", "Transform"] : module2 === "@s2script/sdk/events" || module2 === "@s2script/sdk" ? ["HookResultValue"] : module2 === "@s2script/sdk/entity" ? ["EntityRef"] : [];
+      if (!bindings || !ts2.isNamedImports(bindings) || node.importClause?.name || !bindings.elements.every(
+        (e) => allowed.includes((e.propertyName ?? e.name).text)
+      ))
+        fail(
+          node,
+          "contracts must be self-contained; only SDK Notification, Hook, Transform, HookResultValue and EntityRef imports are supported"
+        );
+    }
+    if (ts2.isExportDeclaration(node) && node.moduleSpecifier || ts2.isImportTypeNode(node) || ts2.isImportEqualsDeclaration(node) || ts2.isModuleDeclaration(node))
+      fail(
+        node,
+        "external declarations and module augmentations are not supported in a contract"
+      );
+    ts2.forEachChild(node, visitImports);
+  };
+  visitImports(sf);
+  if (sf.referencedFiles.length || sf.typeReferenceDirectives.length)
+    fail(sf, "external declaration references are not supported");
+  const diags = [
+    ...program.getSyntacticDiagnostics(sf),
+    ...program.getSemanticDiagnostics(sf)
+  ];
+  if (diags.length)
+    fail(sf, ts2.flattenDiagnosticMessageText(diags[0].messageText, "\n"));
+  const module = checker.getSymbolAtLocation(sf);
+  const symbol2 = module && checker.getExportsOfModule(module).find((s) => s.name === "Contract");
+  if (!symbol2) fail(sf, "protocol 2 requires an exported Contract");
+  const contract = checker.getDeclaredTypeOfSymbol(symbol2);
+  const prop = (type, name, node) => {
+    const p = type.getProperty(name);
+    if (!p) fail(node, `missing ${name}`);
+    return checker.getTypeOfSymbolAtLocation(p, p.valueDeclaration ?? node);
+  };
+  for (const name of ["methods", "forwards"]) {
+    const member = prop(contract, name, sf);
+    if (!(member.flags & ts2.TypeFlags.Object) || member.getCallSignatures().length || checker.getIndexInfosOfType(member).length) {
+      fail(sf, `${name} must be a finite object record`);
+    }
+  }
+  const stack = /* @__PURE__ */ new Set();
+  const schema = (type, node, voidAllowed = false) => {
+    const f = type.flags;
+    if (f & ts2.TypeFlags.Any || f & ts2.TypeFlags.Unknown || f & ts2.TypeFlags.Never)
+      fail(node, `unsupported wire type ${checker.typeToString(type)}`);
+    if (f & ts2.TypeFlags.Void && voidAllowed) return { kind: "void" };
+    if (f & ts2.TypeFlags.Null) return { kind: "null" };
+    if (f & ts2.TypeFlags.StringLiteral)
+      return { kind: "literal", value: type.value };
+    if (f & ts2.TypeFlags.NumberLiteral)
+      return { kind: "literal", value: type.value };
+    if (f & ts2.TypeFlags.BooleanLiteral)
+      return { kind: "literal", value: checker.typeToString(type) === "true" };
+    if (f & ts2.TypeFlags.String) return { kind: "string" };
+    if (f & ts2.TypeFlags.Number) return { kind: "number" };
+    if (f & ts2.TypeFlags.Boolean) return { kind: "boolean" };
+    if (stack.has(type)) fail(node, "recursive wire types are unsupported");
+    stack.add(type);
+    try {
+      if (type.isUnion()) {
+        const variants = type.types.map((t2) => schema(t2, node));
+        const objects = variants.filter((v) => v.kind === "object");
+        if (objects.length > 1 && !Object.keys(objects[0].fields).some(
+          (k) => objects.every(
+            (o) => o.fields[k]?.schema.kind === "literal" && !o.fields[k].optional
+          )
+        ))
+          fail(node, "object unions require a literal discriminant");
+        return { kind: "union", variants };
+      }
+      if (checker.isArrayType(type))
+        return {
+          kind: "array",
+          item: schema(
+            checker.getTypeArguments(type)[0],
+            node
+          )
+        };
+      if (!(f & ts2.TypeFlags.Object) || checker.isTupleType(type) || type.getCallSignatures().length || checker.getIndexInfosOfType(type).length)
+        fail(node, `unsupported wire type ${checker.typeToString(type)}`);
+      const sym = type.getSymbol();
+      if (sym?.name === "EntityRef" && sym.declarations?.some(
+        (d) => d.getSourceFile().fileName === resolve(packagesDir, "sdk/entity.d.ts")
+      ))
+        return { kind: "entityRef" };
+      if (sym?.declarations?.some(
+        (d) => ts2.isClassDeclaration(d) || d.getSourceFile() !== sf
+      ))
+        fail(
+          node,
+          "arbitrary class instances and imported domain types are unsupported"
+        );
+      const fields = /* @__PURE__ */ Object.create(null);
+      for (const p of type.getProperties().sort((a2, b) => a2.name.localeCompare(b.name))) {
+        const decl = p.valueDeclaration ?? node;
+        if (p.name === "__s2ref")
+          fail(decl, "__s2ref is reserved for the EntityRef wire encoding");
+        const optional = !!(p.flags & ts2.SymbolFlags.Optional);
+        let t2 = checker.getTypeOfSymbolAtLocation(p, decl);
+        if (optional && t2.isUnion()) {
+          const parts = t2.types.filter(
+            (t3) => !(t3.flags & ts2.TypeFlags.Undefined)
+          );
+          if (parts.length === 1) t2 = parts[0];
+          else {
+            fields[p.name] = {
+              schema: {
+                kind: "union",
+                variants: parts.map((t3) => schema(t3, decl))
+              },
+              optional
+            };
+            continue;
+          }
+        }
+        fields[p.name] = { schema: schema(t2, decl), optional };
+      }
+      return { kind: "object", fields };
+    } finally {
+      stack.delete(type);
+    }
+  };
+  const methods = /* @__PURE__ */ Object.create(null);
+  for (const p of prop(contract, "methods", sf).getProperties()) {
+    const node = p.valueDeclaration ?? sf, type = checker.getTypeOfSymbolAtLocation(p, node), sigs = type.getCallSignatures();
+    const scanner = ts2.createScanner(
+      ts2.ScriptTarget.ESNext,
+      false,
+      ts2.LanguageVariant.Standard,
+      p.name
+    );
+    const identifier = scanner.scan() === ts2.SyntaxKind.Identifier && scanner.scan() === ts2.SyntaxKind.EndOfFileToken;
+    if (!identifier || ["on", "off", "then"].includes(p.name))
+      fail(node, `unsupported or reserved method name ${p.name}`);
+    const exported = checker.getExportsOfModule(module).find((s) => s.name === p.name);
+    if (exported && (!checker.isTypeAssignableTo(
+      checker.getTypeOfSymbolAtLocation(
+        exported,
+        exported.valueDeclaration ?? sf
+      ),
+      type
+    ) || !checker.isTypeAssignableTo(
+      type,
+      checker.getTypeOfSymbolAtLocation(
+        exported,
+        exported.valueDeclaration ?? sf
+      )
+    )))
+      fail(node, `export ${p.name} must agree with Contract.methods`);
+    if (sigs.length !== 1 || sigs[0].typeParameters?.length || p.flags & ts2.SymbolFlags.Optional)
+      fail(node, "methods require one non-generic synchronous signature");
+    const sig = sigs[0];
+    methods[p.name] = {
+      args: sig.parameters.map((p2) => {
+        const d = p2.valueDeclaration;
+        if (d.dotDotDotToken) fail(d, "rest parameters are unsupported");
+        let t2 = checker.getTypeOfSymbolAtLocation(p2, d);
+        if (d.questionToken && t2.isUnion()) {
+          const parts = t2.types.filter(
+            (t3) => !(t3.flags & ts2.TypeFlags.Undefined)
+          );
+          if (parts.length === 1) t2 = parts[0];
+          else fail(d, "optional union arguments are unsupported");
+        }
+        return { schema: schema(t2, d), optional: !!d.questionToken };
+      }),
+      result: schema(checker.getReturnTypeOfSignature(sig), node, true)
+    };
+  }
+  const forwards = /* @__PURE__ */ Object.create(null);
+  for (const p of prop(contract, "forwards", sf).getProperties()) {
+    const node = p.valueDeclaration ?? sf, type = checker.getTypeOfSymbolAtLocation(p, node);
+    const descriptors = [
+      ["notification", "__notificationPayload"],
+      ["hook", "__hookPayload"],
+      ["transform", "__transformPayload"]
+    ];
+    const descriptor = descriptors.filter(([, key2]) => type.getProperty(key2));
+    if (descriptor.length !== 1)
+      fail(
+        node,
+        "only SDK Notification<P>, Hook<P> and Transform<P,W> forwards are supported"
+      );
+    const [kind, key] = descriptor[0];
+    const brand = type.getProperty(key);
+    if (!brand.declarations?.some(
+      (d) => d.getSourceFile().fileName === resolve(packagesDir, "sdk/interfaces.d.ts")
+    ))
+      fail(node, "forward descriptors must come from the SDK");
+    const payload = schema(
+      checker.getTypeOfSymbolAtLocation(brand, node),
+      node
+    );
+    if (kind === "transform") {
+      if (payload.kind !== "object")
+        fail(node, "Transform requires a finite object payload");
+      const writableType = prop(type, "__transformWritable", node);
+      const keys = writableType.flags & ts2.TypeFlags.Never ? [] : writableType.isUnion() ? writableType.types : [writableType];
+      const writable = keys.map((t2) => {
+        if (!(t2.flags & ts2.TypeFlags.StringLiteral))
+          fail(node, "Transform writable keys must be string field names");
+        const key2 = t2.value;
+        if (!Object.hasOwn(payload.fields, key2))
+          fail(node, "Transform writable key is absent from payload");
+        return key2;
+      }).sort();
+      forwards[p.name] = { kind, payload, writable };
+    } else forwards[p.name] = { kind, payload };
+  }
+  for (const exported of checker.getExportsOfModule(module)) {
+    const typeOnly = exported.declarations?.every(
+      (d) => ts2.isExportSpecifier(d) && (d.isTypeOnly || ts2.isExportDeclaration(d.parent.parent) && d.parent.parent.isTypeOnly)
+    );
+    const target = exported.flags & ts2.SymbolFlags.Alias ? checker.getAliasedSymbol(exported) : exported;
+    if (!typeOnly && target.flags & ts2.SymbolFlags.Value && !Object.hasOwn(methods, exported.name))
+      fail(exported.declarations?.[0] ?? sf, `unsupported value export ${exported.name}; only Contract.methods may export runtime values`);
+  }
+  const metadata = { version: 1, methods, forwards };
+  return {
+    metadata,
+    sha256: createHash("sha256").update(canonical(metadata)).digest("hex")
+  };
+}
+function implementationExpression(checker, expression, seen = /* @__PURE__ */ new Set()) {
+  if (seen.has(expression)) return expression;
+  seen.add(expression);
+  const propertyValue = (receiver, name) => {
+    const object = implementationExpression(checker, receiver, seen);
+    const declaration = checker.getTypeAtLocation(object).getProperty(name)?.valueDeclaration;
+    return declaration && (declarationValue(declaration) ?? declaration);
+  };
+  const declarationValue = (declaration) => {
+    if (seen.has(declaration)) return void 0;
+    seen.add(declaration);
+    if ((ts2.isVariableDeclaration(declaration) || ts2.isPropertyAssignment(declaration)) && declaration.initializer)
+      return implementationExpression(checker, declaration.initializer, seen);
+    if (ts2.isShorthandPropertyAssignment(declaration)) {
+      const value = checker.getShorthandAssignmentValueSymbol(
+        declaration
+      )?.valueDeclaration;
+      return value && declarationValue(value);
+    }
+    if (ts2.isBindingElement(declaration) && ts2.isObjectBindingPattern(declaration.parent)) {
+      const object = declarationValue(declaration.parent.parent);
+      const name = declaration.propertyName ?? declaration.name;
+      if (object && (ts2.isIdentifier(name) || ts2.isStringLiteral(name)))
+        return propertyValue(object, name.text);
+    }
+    return void 0;
+  };
+  if (ts2.isParenthesizedExpression(expression))
+    return implementationExpression(checker, expression.expression, seen);
+  if (ts2.isPropertyAccessExpression(expression))
+    return propertyValue(expression.expression, expression.name.text) ?? expression;
+  if (ts2.isElementAccessExpression(expression) && ts2.isStringLiteralLike(expression.argumentExpression))
+    return propertyValue(
+      expression.expression,
+      expression.argumentExpression.text
+    ) ?? expression;
+  let symbol2 = checker.getSymbolAtLocation(expression);
+  if (symbol2 && symbol2.flags & ts2.SymbolFlags.Alias)
+    symbol2 = checker.getAliasedSymbol(symbol2);
+  return (symbol2?.valueDeclaration && declarationValue(symbol2.valueDeclaration)) ?? expression;
+}
+function checkInteropCalls(program, paths, publishes, generatedPath, pluginDir, dependencies, optionalDependencies) {
+  const checker = program.getTypeChecker(), out = [];
+  const report = (node, message) => out.push({
+    category: ts2.DiagnosticCategory.Error,
+    code: 92002,
+    file: node.getSourceFile(),
+    start: node.getStart(),
+    length: node.getWidth(),
+    messageText: `InterfaceContractError: ${message}`
+  });
+  const contracts = /* @__PURE__ */ new Map();
+  for (const [name, path] of Object.entries(paths)) {
+    const sf = program.getSourceFile(path);
+    const sym = sf && checker.getSymbolAtLocation(sf);
+    const c2 = sym && checker.getExportsOfModule(sym).find((s) => s.name === "Contract");
+    if (c2) contracts.set(name, checker.getDeclaredTypeOfSymbol(c2));
+  }
+  const sdkInterfaces = resolve(
+    program.getCompilerOptions().baseUrl,
+    "sdk/interfaces.d.ts"
+  );
+  for (const sf of program.getSourceFiles()) {
+    const visit = (node) => {
+      if (ts2.isInterfaceDeclaration(node) && node.name.text === "InterfaceContracts" && sf.fileName !== generatedPath && sf.fileName !== sdkInterfaces)
+        report(
+          node,
+          "InterfaceContracts associations are generated; local augmentation is not authority"
+        );
+      if (ts2.isCallExpression(node) && sf.fileName.startsWith(pluginDir + "/")) {
+        const method = pluginApiName(checker, node);
+        if ([
+          "publish",
+          "use",
+          "tryUse",
+          "watchOptional",
+          "bindForwards"
+        ].includes(method ?? "")) {
+          const arg = node.arguments[0];
+          const name = arg && ts2.isStringLiteralLike(arg) ? arg.text : null;
+          if (!name || !contracts.has(name))
+            report(
+              node,
+              `interface ${name ?? "(dynamic name)"} has no verified protocol 2 contract; declare the dependency and run s2s add`
+            );
+          else {
+            if (node.typeArguments?.length)
+              report(
+                node,
+                "protocol 2 infers Contract from the interface name; explicit generic arguments are forbidden"
+              );
+            if (method === "watchOptional" && !optionalDependencies.has(name))
+              report(node, "watchOptional requires an optionalPluginDependencies entry");
+            if (method === "bindForwards" && optionalDependencies.has(name))
+              report(node, "bindForwards requires a pluginDependencies entry");
+            if (method === "watchOptional" && node.arguments[1]) {
+              const callback = node.arguments[1];
+              const type = checker.getTypeAtLocation(implementationExpression(checker, callback));
+              const asynchronous = (type2) => type2.isUnion() ? type2.types.some(asynchronous) : !!(type2.flags & ts2.TypeFlags.Any) || !!type2.getProperty("then");
+              if (type.flags & ts2.TypeFlags.Any || type.getCallSignatures().some((signature) => asynchronous(checker.getReturnTypeOfSignature(signature))))
+                report(callback, "watchOptional requires a synchronous attachment callback; thenables are forbidden");
+            }
+            if (method === "publish") {
+              if (!publishes.has(name))
+                report(node, `provider is not authorized to publish ${name}`);
+              const c2 = contracts.get(name), m = c2.getProperty("methods");
+              const expected = checker.getTypeOfSymbolAtLocation(
+                m,
+                m.valueDeclaration
+              );
+              const impl = node.arguments[1];
+              const actual = impl && checker.getTypeAtLocation(impl);
+              const implementationType = impl && checker.getTypeAtLocation(
+                implementationExpression(checker, impl)
+              );
+              if (!actual || actual.flags & ts2.TypeFlags.Any || !checker.isTypeAssignableTo(actual, expected))
+                report(
+                  impl ?? node,
+                  `producer implementation must agree with ${name} Contract.methods (${checker.typeToString(
+                    expected
+                  )})`
+                );
+              if (actual) {
+                for (const property of actual.getProperties()) {
+                  if (!expected.getProperty(property.name) && checker.getTypeOfSymbolAtLocation(property, impl).getCallSignatures().length) {
+                    report(
+                      impl,
+                      `undeclared method ${property.name} is not in Contract.methods`
+                    );
+                  }
+                }
+              }
+              if (actual) {
+                for (const expectedMethod of expected.getProperties()) {
+                  const implementation = implementationType?.getProperty(
+                    expectedMethod.name
+                  );
+                  if (!implementation) continue;
+                  const required = checker.getTypeOfSymbolAtLocation(expectedMethod, impl).getCallSignatures()[0];
+                  const declaration = implementation.valueDeclaration;
+                  const value = declaration && ts2.isPropertyAssignment(declaration) ? declaration.initializer : declaration && ts2.isShorthandPropertyAssignment(declaration) ? declaration.name : void 0;
+                  const methodType = value ? checker.getTypeAtLocation(
+                    implementationExpression(checker, value)
+                  ) : checker.getTypeOfSymbolAtLocation(implementation, impl);
+                  const signatures = methodType.getCallSignatures();
+                  if (!required || signatures.length !== 1 || signatures[0].typeParameters?.length) {
+                    report(
+                      impl,
+                      `producer method ${expectedMethod.name} signature must be a single non-generic function`
+                    );
+                    continue;
+                  }
+                  const provided = signatures[0];
+                  const result = checker.getReturnTypeOfSignature(provided);
+                  const expectedResult = checker.getReturnTypeOfSignature(required);
+                  const resultMatches = expectedResult.flags & ts2.TypeFlags.Void ? !!(result.flags & (ts2.TypeFlags.Void | ts2.TypeFlags.Undefined | ts2.TypeFlags.Never)) : checker.isTypeAssignableTo(result, expectedResult);
+                  if (result.flags & ts2.TypeFlags.Any || !resultMatches)
+                    report(
+                      impl,
+                      `producer method ${expectedMethod.name} result must agree with its synchronous Contract signature`
+                    );
+                  for (const [i2, parameter] of provided.parameters.entries()) {
+                    const declaration2 = parameter.valueDeclaration;
+                    if (declaration2 && ts2.isParameter(declaration2) && declaration2.dotDotDotToken) {
+                      report(
+                        impl,
+                        `producer method ${expectedMethod.name} signature cannot use rest parameters`
+                      );
+                      continue;
+                    }
+                    const input = checker.getTypeOfSymbolAtLocation(
+                      parameter,
+                      impl
+                    );
+                    const contractParameter = required.parameters[i2];
+                    if (!contractParameter) {
+                      if (!(parameter.flags & ts2.SymbolFlags.Optional) && !(declaration2 && ts2.isParameter(declaration2) && (declaration2.questionToken || declaration2.initializer)))
+                        report(
+                          impl,
+                          `producer method ${expectedMethod.name} requires an undeclared input`
+                        );
+                    } else {
+                      const requiredInput = checker.getTypeOfSymbolAtLocation(
+                        contractParameter,
+                        impl
+                      );
+                      const variants = requiredInput.isUnion() ? requiredInput.types : [requiredInput];
+                      const hasDefault = declaration2 && ts2.isParameter(declaration2) && declaration2.initializer;
+                      if (!variants.every(
+                        (type) => hasDefault && !!(type.flags & ts2.TypeFlags.Undefined) || checker.isTypeAssignableTo(type, input)
+                      ))
+                        report(
+                          impl,
+                          `producer method ${expectedMethod.name} input ${parameter.name} is narrower than its Contract signature`
+                        );
+                    }
+                  }
+                }
+              }
+            } else if (!dependencies.has(name))
+              report(node, `undeclared dependency ${name}`);
+          }
+        }
+      }
+      ts2.forEachChild(node, visit);
+    };
+    visit(sf);
+  }
+  return out;
+}
+
+// src/publishes.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readFileSync } from "node:fs";
+function expandPublishes(authored, pkgName, pkgVersion) {
+  if (authored === void 0 || authored === null) return {};
+  if (typeof authored === "string") {
+    if (authored.trim() !== "self") {
+      throw new Error(
+        `publishes: the only valid string form is "self" (got ${JSON.stringify(authored)}); use the map form to publish a differently-named contract`
+      );
+    }
+    return { [pkgName]: pkgVersion };
+  }
+  if (typeof authored !== "object") {
+    throw new Error(`publishes must be "self" or an object (got ${typeof authored})`);
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [iface, range] of Object.entries(authored)) {
+    if (typeof range !== "string") {
+      throw new Error(`publishes[${JSON.stringify(iface)}] must be a version range string`);
+    }
+    out[iface] = range;
+  }
+  return out;
+}
+function hashContract(typesPath) {
+  return createHash2("sha256").update(readFileSync(typesPath)).digest("hex");
+}
+var CONCRETE_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+function isConcreteVersion(v) {
+  return CONCRETE_SEMVER.test(v.trim());
+}
+function derivePublishes(authored, pkgName, pkgVersion, typesPath) {
+  const expanded = expandPublishes(authored, pkgName, pkgVersion);
+  const names = Object.keys(expanded);
+  if (names.length === 0) return {};
+  if (names.length > 1) {
+    throw new Error(
+      `publishes declares ${names.length} interfaces (${names.join(", ")}) but a plugin ships a single "types" contract, so they would all carry the SAME typesSha256 \u2014 a hash that cannot say which contract is which. Publish one interface per plugin (a per-interface "types" map is not supported).`
+    );
+  }
+  if (typesPath === null) {
+    throw new Error(
+      `publishes is set but no contract .d.ts was resolved \u2014 set "types": "api.d.ts" in package.json`
+    );
+  }
+  for (const [iface, v] of Object.entries(expanded)) {
+    if (!isConcreteVersion(v)) {
+      throw new Error(
+        `publishes[${JSON.stringify(iface)}] = ${JSON.stringify(v)} is a RANGE. Resolving a range against a published contract requires the registry (design spec \xA74.6, \xA710 \u2014 not yet implemented). Use a concrete version for a contract you ship yourself, or "self".`
+      );
+    }
+  }
+  const typesSha256 = hashContract(typesPath);
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const name of names) {
+    out[name] = { version: expanded[name].trim(), typesSha256 };
+  }
+  return out;
+}
+
+// src/typecheck/typecheck.ts
+import {
+  mkdirSync,
+  existsSync as existsSync6,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync6,
+  writeFileSync,
+  rmSync,
+  mkdtempSync
+} from "node:fs";
+import { join as join7, resolve as resolve7, dirname as dirname3 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/packages-resolve.ts
 import { existsSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function isPackagesDir(dir) {
-  const abs = resolve(dir);
+  const abs = resolve2(dir);
   return existsSync(join(abs, "sdk", "globals.d.ts")) || existsSync(join(abs, "sdk", "entity.d.ts"));
 }
 function findPackagesDirNearCli(fromCliUrl = import.meta.url) {
   const start = dirname(fileURLToPath(fromCliUrl));
   for (const rel of ["../..", "../../.."]) {
     const candidate = join(start, rel);
-    if (isPackagesDir(candidate)) return resolve(candidate);
+    if (isPackagesDir(candidate)) return resolve2(candidate);
   }
   return void 0;
 }
 function resolvePackagesDir(opts) {
   if (opts?.explicit) {
-    const abs = resolve(opts.explicit);
+    const abs = resolve2(opts.explicit);
     if (!isPackagesDir(abs)) {
       throw new Error(`packages dir does not look like @s2script stubs: ${abs}`);
     }
@@ -3103,7 +3744,7 @@ function resolvePackagesDir(opts) {
   }
   const env = process.env.S2SCRIPT_PACKAGES_DIR;
   if (env) {
-    const abs = resolve(env);
+    const abs = resolve2(env);
     if (!isPackagesDir(abs)) {
       throw new Error(`S2SCRIPT_PACKAGES_DIR does not look like @s2script stubs: ${abs}`);
     }
@@ -3112,7 +3753,7 @@ function resolvePackagesDir(opts) {
   const nearCli = findPackagesDirNearCli(opts?.fromCliUrl);
   if (nearCli) return nearCli;
   if (opts?.pluginDir) {
-    const nm = join(resolve(opts.pluginDir), "node_modules", "@s2script");
+    const nm = join(resolve2(opts.pluginDir), "node_modules", "@s2script");
     if (isPackagesDir(nm)) return nm;
   }
   throw new Error(
@@ -3120,32 +3761,6 @@ function resolvePackagesDir(opts) {
   );
 }
 
-// src/tsconfig-shared.ts
-var sharedCompilerOptionsJson = {
-  strict: true,
-  noEmit: true,
-  moduleResolution: "bundler",
-  module: "ESNext",
-  target: "ES2024",
-  lib: ["ES2024"],
-  types: [],
-  skipLibCheck: true,
-  allowImportingTsExtensions: true
-};
-function sharedProgramOptions(tsMod) {
-  return {
-    strict: sharedCompilerOptionsJson.strict,
-    noEmit: sharedCompilerOptionsJson.noEmit,
-    allowImportingTsExtensions: sharedCompilerOptionsJson.allowImportingTsExtensions,
-    moduleResolution: tsMod.ModuleResolutionKind.Bundler,
-    module: tsMod.ModuleKind.ESNext,
-    target: tsMod.ScriptTarget.ES2024,
-    lib: sharedCompilerOptionsJson.lib.map((l2) => `lib.${l2.toLowerCase()}.d.ts`),
-    types: [...sharedCompilerOptionsJson.types],
-    skipLibCheck: sharedCompilerOptionsJson.skipLibCheck
-  };
-}
-
 // src/contracts.ts
 import { existsSync as existsSync2 } from "node:fs";
 import { join as join2 } from "node:path";
@@ -3158,7 +3773,7 @@ function localContractPath(pluginDir, dep) {
 
 // src/workspace/siblings.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import { join as join5, relative, resolve as resolve4 } from "node:path";
+import { join as join5, relative, resolve as resolve5 } from "node:path";
 
 // src/workspace/glob.ts
 function toPosix(p) {
@@ -3191,11 +3806,11 @@ function matchGlob(pattern, path) {
 }
 
 // src/workspace/workspace.ts
-import { existsSync as existsSync3, readFileSync, readdirSync, statSync } from "node:fs";
-import { dirname as dirname2, join as join3, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync, statSync } from "node:fs";
+import { dirname as dirname2, join as join3, resolve as resolve3 } from "node:path";
 function readPackageJson(path) {
   try {
-    return JSON.parse(readFileSync(path, "utf8"));
+    return JSON.parse(readFileSync2(path, "utf8"));
   } catch (e) {
     throw new Error(`cannot read ${path}: ${e.message}`);
   }
@@ -3204,7 +3819,7 @@ var MARKER_TEXT = /"s2script"[\s\S]*"workspace"\s*:/;
 function carriesWorkspaceMarker(pkgPath) {
   let text3;
   try {
-    text3 = readFileSync(pkgPath, "utf8");
+    text3 = readFileSync2(pkgPath, "utf8");
   } catch {
     return false;
   }
@@ -3216,7 +3831,7 @@ function carriesWorkspaceMarker(pkgPath) {
   }
 }
 function findWorkspaceRoot(from) {
-  let dir = resolve2(from);
+  let dir = resolve3(from);
   for (; ; ) {
     if (carriesWorkspaceMarker(join3(dir, "package.json"))) return dir;
     const parent = dirname2(dir);
@@ -3275,7 +3890,7 @@ function pnpmWorkspaceGlobs(root) {
   if (!existsSync3(path)) return [];
   let body;
   try {
-    body = readFileSync(path, "utf8");
+    body = readFileSync2(path, "utf8");
   } catch {
     return [];
   }
@@ -3316,7 +3931,7 @@ function loadWorkspace(root) {
   return workspace;
 }
 function readWorkspace(root) {
-  const absRoot = resolve2(root);
+  const absRoot = resolve3(root);
   const pkg = readPackageJson(join3(absRoot, "package.json"));
   const marker = pkg.s2script?.workspace;
   if (marker === void 0) {
@@ -3415,72 +4030,11 @@ function readWorkspace(root) {
   return { workspace: { root: absRoot, pkg, plugins, libs }, problems };
 }
 function memberForDir(ws, dir) {
-  const abs = toPosix(resolve2(dir));
+  const abs = toPosix(resolve3(dir));
   for (const m of [...ws.plugins, ...ws.libs]) if (toPosix(m.dir) === abs) return m;
   return null;
 }
 
-// src/publishes.ts
-import { createHash } from "node:crypto";
-import { readFileSync as readFileSync2 } from "node:fs";
-function expandPublishes(authored, pkgName, pkgVersion) {
-  if (authored === void 0 || authored === null) return {};
-  if (typeof authored === "string") {
-    if (authored.trim() !== "self") {
-      throw new Error(
-        `publishes: the only valid string form is "self" (got ${JSON.stringify(authored)}); use the map form to publish a differently-named contract`
-      );
-    }
-    return { [pkgName]: pkgVersion };
-  }
-  if (typeof authored !== "object") {
-    throw new Error(`publishes must be "self" or an object (got ${typeof authored})`);
-  }
-  const out = {};
-  for (const [iface, range] of Object.entries(authored)) {
-    if (typeof range !== "string") {
-      throw new Error(`publishes[${JSON.stringify(iface)}] must be a version range string`);
-    }
-    out[iface] = range;
-  }
-  return out;
-}
-function hashContract(typesPath) {
-  return createHash("sha256").update(readFileSync2(typesPath)).digest("hex");
-}
-var CONCRETE_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-function isConcreteVersion(v) {
-  return CONCRETE_SEMVER.test(v.trim());
-}
-function derivePublishes(authored, pkgName, pkgVersion, typesPath) {
-  const expanded = expandPublishes(authored, pkgName, pkgVersion);
-  const names = Object.keys(expanded);
-  if (names.length === 0) return {};
-  if (names.length > 1) {
-    throw new Error(
-      `publishes declares ${names.length} interfaces (${names.join(", ")}) but a plugin ships a single "types" contract, so they would all carry the SAME typesSha256 \u2014 a hash that cannot say which contract is which. Publish one interface per plugin (a per-interface "types" map is not supported).`
-    );
-  }
-  if (typesPath === null) {
-    throw new Error(
-      `publishes is set but no contract .d.ts was resolved \u2014 set "types": "api.d.ts" in package.json`
-    );
-  }
-  for (const [iface, v] of Object.entries(expanded)) {
-    if (!isConcreteVersion(v)) {
-      throw new Error(
-        `publishes[${JSON.stringify(iface)}] = ${JSON.stringify(v)} is a RANGE. Resolving a range against a published contract requires the registry (design spec \xA74.6, \xA710 \u2014 not yet implemented). Use a concrete version for a contract you ship yourself, or "self".`
-      );
-    }
-  }
-  const typesSha256 = hashContract(typesPath);
-  const out = {};
-  for (const name of names) {
-    out[name] = { version: expanded[name].trim(), typesSha256 };
-  }
-  return out;
-}
-
 // src/workspace/interfaces.ts
 function where(p) {
   return `${p.name} (${p.relDir})`;
@@ -3523,7 +4077,7 @@ function ambiguityProblem(iface, publishers) {
 
 // src/publish-gate.ts
 import { existsSync as existsSync4, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { join as join4, resolve as resolve3 } from "node:path";
+import { join as join4, resolve as resolve4 } from "node:path";
 function hasPublishes(publishes) {
   if (publishes == null) return false;
   if (typeof publishes === "string") return publishes.trim().length > 0;
@@ -3548,7 +4102,7 @@ function assertPublishesTypes(pkg, pluginDir) {
       error: `published API must be a .d.ts file (got ${JSON.stringify(typesRel)})`
     };
   }
-  const typesPath = resolve3(pluginDir, typesRel);
+  const typesPath = resolve4(pluginDir, typesRel);
   if (!existsSync4(typesPath)) {
     return { ok: false, error: `types file not found: ${typesRel}` };
   }
@@ -3579,7 +4133,7 @@ function resolveSiblingContracts(pluginDir, deps) {
   const siblings = /* @__PURE__ */ new Map();
   const shadowedCopies = [];
   if (deps.length === 0) return { siblings, shadowedCopies };
-  const absDir = resolve4(pluginDir);
+  const absDir = resolve5(pluginDir);
   const root = findWorkspaceRoot(absDir);
   if (root === null) return { siblings, shadowedCopies };
   const rootPkg = JSON.parse(readFileSync4(join5(root, "package.json"), "utf8"));
@@ -3587,7 +4141,7 @@ function resolveSiblingContracts(pluginDir, deps) {
   const scan = scanWorkspace(root);
   const ws = scan.workspace;
   const { producers, ambiguous, byPlugin } = indexInterfaces(ws.plugins);
-  const self = ws.plugins.find((p) => resolve4(p.dir) === absDir);
+  const self = ws.plugins.find((p) => resolve5(p.dir) === absDir);
   const label = self?.name ?? toPosix(relative(root, absDir));
   const unread = scan.problems ?? [];
   const problems = [];
@@ -3599,7 +4153,7 @@ function resolveSiblingContracts(pluginDir, deps) {
     }
     const producer = producers.get(dep);
     if (producer === void 0) {
-      const namesake = ws.plugins.find((p) => p.name === dep && resolve4(p.dir) !== absDir);
+      const namesake = ws.plugins.find((p) => p.name === dep && resolve5(p.dir) !== absDir);
       if (namesake !== void 0 && (byPlugin.get(namesake)?.length ?? 0) === 0) {
         problems.push(
           `${dep} (workspace sibling at ${namesake.relDir}) declares no s2script.publishes \u2014 you cannot depend on an interface nobody publishes. The engine resolves a dependency name through iface_published (loader.rs:175), which is never true for a plugin that publishes nothing, so this consumer would park in "waiting" forever and every ctx.use would throw InterfaceUnavailable. Add s2script.publishes and "types" to ${namesake.relDir}/package.json.`
@@ -3614,7 +4168,7 @@ function resolveSiblingContracts(pluginDir, deps) {
       continue;
     }
     const sib = producer.plugin;
-    if (resolve4(sib.dir) === absDir) continue;
+    if (resolve5(sib.dir) === absDir) continue;
     const gate = assertPublishesTypes(sib.pkg, sib.dir);
     if (!gate.ok || gate.typesPath === null) {
       const why = gate.ok ? "it declares no s2script.publishes" : gate.error;
@@ -3637,7 +4191,7 @@ function resolveSiblingContracts(pluginDir, deps) {
 
 // src/libraries.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import { join as join6, resolve as resolve5 } from "node:path";
+import { join as join6, resolve as resolve6 } from "node:path";
 function packageKind(pkg) {
   const k = pkg.s2script?.kind ?? "plugin";
   if (k !== "plugin" && k !== "library") {
@@ -3655,7 +4209,7 @@ function localLibraryDir(pluginDir, name) {
   return existsSync5(join6(p, "index.d.ts")) ? p : null;
 }
 function resolveLibrarySibling(pluginDir, name) {
-  const absDir = resolve5(pluginDir);
+  const absDir = resolve6(pluginDir);
   const root = findWorkspaceRoot(absDir);
   if (root === null) return null;
   const scan = scanWorkspace(root);
@@ -3690,7 +4244,7 @@ function resolveLibrarySibling(pluginDir, name) {
       `library ${name} (workspace sibling at ${lib.relDir}) has no "types" in its package.json`
     );
   }
-  const typesPath = resolve5(lib.dir, typesRel);
+  const typesPath = resolve6(lib.dir, typesRel);
   if (!existsSync5(typesPath)) {
     throw new Error(
       `library ${name} (workspace sibling at ${lib.relDir}) types file not found: ${typesRel}`
@@ -3783,18 +4337,22 @@ function declaredModules(dtsFiles) {
   const out = /* @__PURE__ */ new Set();
   for (const f of dtsFiles) {
     const body = readFileSync6(f, "utf8");
-    for (const m of body.matchAll(/declare\s+module\s+["']([^"']+)["']/g)) out.add(m[1]);
+    for (const m of body.matchAll(/declare\s+module\s+["']([^"']+)["']/g))
+      out.add(m[1]);
   }
   return out;
 }
 function typecheckPlugin(pluginDir, opts) {
-  const absDir = resolve6(pluginDir);
-  const packagesDir = opts?.packagesDir ? resolve6(opts.packagesDir) : resolvePackagesDir({ pluginDir: absDir });
+  const absDir = resolve7(pluginDir);
+  const packagesDir = opts?.packagesDir ? resolve7(opts.packagesDir) : resolvePackagesDir({ pluginDir: absDir });
   const pkg = JSON.parse(readFileSync6(join7(absDir, "package.json"), "utf8"));
   const s2 = pkg.s2script ?? {};
   const entryRel = s2.main ?? pkg.main;
-  if (!entryRel) throw new Error(`typecheckPlugin: no entry point in ${join7(absDir, "package.json")}`);
-  const entry = resolve6(absDir, entryRel);
+  if (!entryRel)
+    throw new Error(
+      `typecheckPlugin: no entry point in ${join7(absDir, "package.json")}`
+    );
+  const entry = resolve7(absDir, entryRel);
   const isAlwaysResolved = (d) => d === "@s2script/sdk" || d.startsWith("@s2script/sdk/") || d === "@s2script/cs2" || d.startsWith("@s2script/cs2/");
   const localDts = localDeclarationFiles(absDir);
   const locallyDeclared = declaredModules(localDts);
@@ -3803,7 +4361,7 @@ function typecheckPlugin(pluginDir, opts) {
     ...Object.keys(s2.optionalPluginDependencies ?? {})
   ];
   const { siblings } = resolveSiblingContracts(absDir, allDeclaredDeps);
-  const contractPaths = {};
+  const contractPaths = /* @__PURE__ */ Object.create(null);
   for (const d of allDeclaredDeps) {
     const sibling = siblings.get(d);
     if (sibling !== void 0) {
@@ -3813,6 +4371,53 @@ function typecheckPlugin(pluginDir, opts) {
     const p = localContractPath(absDir, d);
     if (p !== null) contractPaths[d] = [p];
   }
+  const protocol2 = s2.interfaceProtocol === 2;
+  const authoritativePaths = Object.fromEntries(
+    Object.entries(contractPaths).map(([name, paths]) => [name, paths[0]])
+  );
+  const ownNames = new Set(
+    Object.keys(expandPublishes(s2.publishes, pkg.name, pkg.version))
+  );
+  if (protocol2 && pkg.types && ownNames.size === 0) ownNames.add(pkg.name);
+  if (protocol2 && pkg.types)
+    for (const name of ownNames)
+      authoritativePaths[name] = resolve7(absDir, pkg.types);
+  const interfaceContracts = /* @__PURE__ */ Object.create(null);
+  if (protocol2) {
+    try {
+      for (const dep of allDeclaredDeps)
+        if (!authoritativePaths[dep])
+          throw new Error(
+            `InterfaceContractError: ${dep} has no verified contract copy; run s2s add`
+          );
+      for (const [name, path] of Object.entries(authoritativePaths)) {
+        interfaceContracts[name] = extractContract(path, packagesDir);
+        if (!siblings.has(name) && !ownNames.has(name)) {
+          const receipt = join7(dirname3(path), "package.json");
+          if (existsSync6(receipt)) {
+            const published = JSON.parse(readFileSync6(receipt, "utf8")).s2script?.publishes?.[name];
+            if (!published || published.typesSha256 !== hashContract(path) || published.contract?.sha256 !== interfaceContracts[name].sha256)
+              throw new Error(
+                `InterfaceContractError: ${name} verified copy hash drift; run s2s add`
+              );
+          }
+        }
+      }
+    } catch (e) {
+      return {
+        ok: false,
+        diagnostics: [
+          {
+            file: entry,
+            line: 1,
+            col: 1,
+            code: 92001,
+            message: e.message
+          }
+        ]
+      };
+    }
+  }
   const libraryPaths = resolveLibraries(absDir, s2.libraries ?? {}).paths;
   const libraryNames = new Set(Object.keys(s2.libraries ?? {}));
   const deps = [
@@ -3826,7 +4431,7 @@ function typecheckPlugin(pluginDir, opts) {
   const options = {
     // Accept explicit `.ts` import extensions (node type-stripping requires them for source-to-source
     // imports; esbuild strips them at bundle time). Backward-compatible — extensionless imports still resolve.
-    ...sharedProgramOptions(ts),
+    ...sharedProgramOptions(ts3),
     baseUrl: packagesDir,
     paths: {
       // Builtins: the root barrel `@s2script/sdk` → packages/sdk/index.d.ts; subpaths
@@ -3854,16 +4459,60 @@ function typecheckPlugin(pluginDir, opts) {
   ];
   const tmp = mkdtempSync(join7(tmpdir(), "s2tc-"));
   try {
-    if (deps.length) {
+    const generatedPath = join7(absDir, ".s2script", "interfaces.d.ts");
+    rmSync(generatedPath, { force: true });
+    if (protocol2) {
+      mkdirSync(join7(absDir, ".s2script"), { recursive: true });
+      let moduleId = 0;
+      for (const name of allDeclaredDeps) {
+        const path = authoritativePaths[name], wrapper = join7(tmp, `contract-${moduleId++}.d.ts`);
+        writeFileSync(
+          wrapper,
+          `import type {Contract} from ${JSON.stringify(
+            path
+          )};
+export * from ${JSON.stringify(path)};
+export declare const on: import("@s2script/sdk/interfaces").TypedInterfaceHandle<Contract>["on"];
+` + Object.keys(interfaceContracts[name].metadata.methods).map(
+            (method) => `export declare const ${method}: Contract["methods"][${JSON.stringify(
+              method
+            )}];`
+          ).join("\n")
+        );
+        options.paths[name] = [wrapper];
+      }
+      writeFileSync(
+        generatedPath,
+        'import "@s2script/sdk/interfaces";\n' + Object.entries(authoritativePaths).map(
+          ([name, path], i2) => `import type { Contract as C${i2} } from ${JSON.stringify(
+            path
+          )};`
+        ).join("\n") + '\ndeclare module "@s2script/sdk/interfaces" { interface InterfaceContracts {\n' + Object.keys(authoritativePaths).map((name, i2) => `${JSON.stringify(name)}: C${i2};`).join("\n") + "\n} }\n"
+      );
+      rootNames.push(generatedPath);
+    }
+    if (deps.length && !protocol2) {
       const stub = join7(tmp, "ambient.d.ts");
-      writeFileSync(stub, deps.map((d) => `declare module ${JSON.stringify(d)};`).join("\n") + "\n");
+      writeFileSync(
+        stub,
+        deps.map((d) => `declare module ${JSON.stringify(d)};`).join("\n") + "\n"
+      );
       rootNames.push(stub);
     }
-    const program = ts.createProgram(rootNames, options);
+    const program = ts3.createProgram(rootNames, options);
     const diags = [
       ...program.getSyntacticDiagnostics(),
       ...program.getSemanticDiagnostics(),
-      ...program.getGlobalDiagnostics()
+      ...program.getGlobalDiagnostics(),
+      ...protocol2 ? checkInteropCalls(
+        program,
+        authoritativePaths,
+        ownNames,
+        generatedPath,
+        absDir,
+        new Set(allDeclaredDeps),
+        new Set(Object.keys(s2.optionalPluginDependencies ?? {}))
+      ) : []
     ];
     const out = diags.map((d) => {
       let file = "?", line = 0, col = 0;
@@ -3873,9 +4522,21 @@ function typecheckPlugin(pluginDir, opts) {
         line = lc2.line + 1;
         col = lc2.character + 1;
       }
-      return { file, line, col, code: d.code, message: ts.flattenDiagnosticMessageText(d.messageText, "\n") };
+      return {
+        file,
+        line,
+        col,
+        code: d.code,
+        message: ts3.flattenDiagnosticMessageText(d.messageText, "\n")
+      };
     });
-    return { ok: out.length === 0, diagnostics: out, program };
+    return {
+      ok: out.length === 0,
+      diagnostics: out,
+      program,
+      interfaceContracts,
+      contractPaths: authoritativePaths
+    };
   } finally {
     rmSync(tmp, { recursive: true, force: true });
   }
@@ -3982,15 +4643,15 @@ function validateDecl(full, decl, typeStr, errs) {
 }
 
 // src/api-version.ts
-var HOST_API_VERSION_MAJOR = 2;
+var HOST_API_VERSION_MAJOR = 3;
 var STAMPED_API_VERSION = `${HOST_API_VERSION_MAJOR}.x`;
 
 // src/npm-deps-gate.ts
 import { lstatSync, realpathSync } from "node:fs";
-import { dirname as dirname3, join as join8, resolve as resolve7, sep } from "node:path";
+import { dirname as dirname4, join as join8, resolve as resolve8, sep } from "node:path";
 function findInNodeModules(startDir, dep) {
   const segs = dep.split("/");
-  let dir = resolve7(startDir);
+  let dir = resolve8(startDir);
   for (; ; ) {
     const candidate = join8(dir, "node_modules", ...segs);
     try {
@@ -3998,7 +4659,7 @@ function findInNodeModules(startDir, dep) {
       return candidate;
     } catch {
     }
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -4033,13 +4694,13 @@ function assertNoNpmRuntimeDeps(pkg, pluginDir) {
 
 // src/build-library.ts
 import * as esbuild from "esbuild";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, mkdirSync, existsSync as existsSync8, statSync as statSync3 } from "node:fs";
-import { resolve as resolve9, join as join10 } from "node:path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync8, statSync as statSync3 } from "node:fs";
+import { resolve as resolve10, join as join10 } from "node:path";
 
 // src/lint/lint.ts
 import { ESLint } from "eslint";
 import { existsSync as existsSync7, readdirSync as readdirSync3 } from "node:fs";
-import { dirname as dirname4, join as join9, resolve as resolve8 } from "node:path";
+import { dirname as dirname5, join as join9, resolve as resolve9 } from "node:path";
 import s2lint from "@s2script/eslint-plugin";
 var CONFIG_FILES = ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs", "eslint.config.ts"];
 function ownConfigDir(pluginDir) {
@@ -4048,7 +4709,7 @@ function ownConfigDir(pluginDir) {
   for (; ; ) {
     if (CONFIG_FILES.some((f) => existsSync7(join9(dir, f)))) return dir;
     if (stopAt === null || dir === stopAt) return null;
-    const parent = dirname4(dir);
+    const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -4070,7 +4731,7 @@ function collectTsFiles(dir) {
   return out;
 }
 async function lintPlugin(pluginDir, program) {
-  const absDir = resolve8(pluginDir);
+  const absDir = resolve9(pluginDir);
   const configDir = ownConfigDir(absDir);
   const hasOwnConfig = configDir !== null;
   const eslint = hasOwnConfig ? new ESLint({ cwd: configDir, errorOnUnmatchedPattern: false, warnIgnored: false }) : new ESLint({
@@ -4091,7 +4752,7 @@ async function lintPlugin(pluginDir, program) {
 
 // src/build-library.ts
 async function buildLibrary(dir, packagesDir) {
-  const absDir = resolve9(dir);
+  const absDir = resolve10(dir);
   const pkgPath = join10(absDir, "package.json");
   const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
   const s2 = pkg.s2script ?? {};
@@ -4107,7 +4768,7 @@ async function buildLibrary(dir, packagesDir) {
   if (typeof typesRel !== "string" || !typesRel.endsWith(".d.ts")) {
     throw new Error('a library must set "types" to a .d.ts \u2014 consumers vendor it to typecheck against');
   }
-  const typesPath = resolve9(absDir, typesRel);
+  const typesPath = resolve10(absDir, typesRel);
   if (!existsSync8(typesPath) || !statSync3(typesPath).isFile() || statSync3(typesPath).size === 0) {
     throw new Error(`types file is missing or empty: ${typesRel}`);
   }
@@ -4154,7 +4815,7 @@ ${lint.output}`);
   };
   const sanitized = String(pkg.name).replace(/[^a-zA-Z0-9._-]/g, "_");
   const outDir = join10(absDir, "dist");
-  mkdirSync(outDir, { recursive: true });
+  mkdirSync2(outDir, { recursive: true });
   const outPath = join10(outDir, `${sanitized}.s2lib`);
   writeFileSync2(
     outPath,
@@ -4167,78 +4828,6 @@ ${lint.output}`);
   return outPath;
 }
 
-// src/publish-scan.ts
-import ts2 from "typescript";
-function isPluginContext(type) {
-  const sym = type.getSymbol() ?? type.aliasSymbol;
-  return sym?.getName() === "PluginContext";
-}
-function isFromPluginDts(checker, node) {
-  let sym = checker.getSymbolAtLocation(node);
-  if (sym === void 0) return false;
-  if (sym.flags & ts2.SymbolFlags.Alias) {
-    const aliased = checker.getAliasedSymbol(sym);
-    if (aliased !== void 0) sym = aliased;
-  }
-  for (const d of sym.declarations ?? []) {
-    const f = d.getSourceFile().fileName.replace(/\\/g, "/");
-    if (f.endsWith("/plugin.d.ts")) return true;
-  }
-  return false;
-}
-function recordPublishOrUse(out, method, arg0, sf, node) {
-  if (method === "publish") {
-    if (arg0 !== void 0 && ts2.isStringLiteralLike(arg0)) {
-      out.publishNames.push(arg0.text);
-    } else {
-      const { line } = sf.getLineAndCharacterOfPosition(node.getStart());
-      out.dynamicPublishSites.push(`${sf.fileName}:${line + 1}`);
-    }
-  } else if (arg0 !== void 0 && ts2.isStringLiteralLike(arg0)) {
-    out.useNames.push(arg0.text);
-  }
-}
-function recordImportSpecifier(out, spec) {
-  if (spec.startsWith(".") || spec.startsWith("@s2script/")) return;
-  out.importNames.push(spec);
-}
-function scanPluginProgram(program, pluginDir) {
-  const checker = program.getTypeChecker();
-  const out = { publishNames: [], dynamicPublishSites: [], useNames: [], importNames: [] };
-  const dirPrefix = pluginDir.replace(/\\/g, "/").replace(/\/+$/, "") + "/";
-  for (const sf of program.getSourceFiles()) {
-    if (sf.isDeclarationFile) continue;
-    if (!sf.fileName.replace(/\\/g, "/").startsWith(dirPrefix)) continue;
-    const visit = (node) => {
-      if ((ts2.isImportDeclaration(node) || ts2.isExportDeclaration(node)) && node.moduleSpecifier !== void 0 && ts2.isStringLiteralLike(node.moduleSpecifier)) {
-        recordImportSpecifier(out, node.moduleSpecifier.text);
-      }
-      if (ts2.isCallExpression(node)) {
-        if (ts2.isPropertyAccessExpression(node.expression)) {
-          const method = node.expression.name.text;
-          if (method === "publish" || method === "use" || method === "tryUse") {
-            const recv = checker.getTypeAtLocation(node.expression.expression);
-            if (isPluginContext(recv)) {
-              recordPublishOrUse(out, method, node.arguments[0], sf, node);
-            }
-          }
-        } else if (ts2.isIdentifier(node.expression)) {
-          const name = node.expression.text;
-          if ((name === "publish" || name === "use" || name === "tryUse") && isFromPluginDts(checker, node.expression)) {
-            recordPublishOrUse(out, name, node.arguments[0], sf, node);
-          }
-        }
-      }
-      ts2.forEachChild(node, visit);
-    };
-    visit(sf);
-  }
-  out.publishNames = [...new Set(out.publishNames)];
-  out.useNames = [...new Set(out.useNames)];
-  out.importNames = [...new Set(out.importNames)];
-  return out;
-}
-
 // src/gamedata/types.ts
 var PLATFORM = "linuxsteamrt64";
 var ARG_KINDS = ["bool", "int", "float", "string", "utlstring", "vector", "entity"];
@@ -4744,7 +5333,7 @@ function stripJsonComments(src) {
 
 // src/build.ts
 async function buildPlugin(dir, packagesDir) {
-  const absDir = resolve10(dir);
+  const absDir = resolve11(dir);
   const pkgPath = join11(absDir, "package.json");
   const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
   if (packageKind(pkg) === "library") {
@@ -4774,7 +5363,7 @@ async function buildPlugin(dir, packagesDir) {
   const permissions = Array.isArray(s2.permissions) ? s2.permissions : [];
   let gamedata;
   if (typeof s2.gamedata === "string") {
-    const gdPath = resolve10(absDir, s2.gamedata);
+    const gdPath = resolve11(absDir, s2.gamedata);
     const dirPrefix = absDir.endsWith(sep2) ? absDir : absDir + sep2;
     if (gdPath !== absDir && !gdPath.startsWith(dirPrefix)) {
       throw new Error(
@@ -4799,7 +5388,7 @@ async function buildPlugin(dir, packagesDir) {
     if (gdErrs.length) throw new Error(`invalid gamedata:
   ${gdErrs.join("\n  ")}`);
     const genDir = join11(absDir, ".s2script");
-    mkdirSync2(genDir, { recursive: true });
+    mkdirSync3(genDir, { recursive: true });
     writeFileSync3(join11(genDir, "gamedata.d.ts"), generateGamedataTypes(gamedata));
     if (gamedata.hooks && Object.keys(gamedata.hooks).length) {
       writeFileSync3(join11(genDir, "hooks.d.ts"), generateHookTypes(gamedata));
@@ -4935,9 +5524,18 @@ ${lint.output}`);
   if (Object.keys(derivedPublishes).length > 0) {
     manifest.publishes = derivedPublishes;
   }
+  if (s2.interfaceProtocol === 2) {
+    manifest.interfaceProtocol = 2;
+    const imports = /* @__PURE__ */ Object.create(null);
+    for (const [name2, contract] of Object.entries(tc.interfaceContracts ?? {})) {
+      if (derivedPublishes[name2]) Object.assign(derivedPublishes[name2], { contract });
+      if (declaredDeps.has(name2)) imports[name2] = contract;
+    }
+    manifest.interfaceContracts = imports;
+  }
   if (config !== void 0) manifest.config = config;
   if (permissions.length > 0) manifest.permissions = permissions;
-  const compiledAgainst = {};
+  const compiledAgainst = /* @__PURE__ */ Object.create(null);
   for (const dep of [
     ...Object.keys(pluginDependencies),
     ...Object.keys(optionalPluginDependencies)
@@ -4965,13 +5563,13 @@ ${lint.output}`);
   }
   const sanitizedId = name.replace(/[^a-zA-Z0-9._-]/g, "_");
   const outDir = join11(absDir, "dist");
-  mkdirSync2(outDir, { recursive: true });
+  mkdirSync3(outDir, { recursive: true });
   const outPath = join11(outDir, `${sanitizedId}.s2sp`);
   writeFileSync3(outPath, zipSync(zipFiles));
   return outPath;
 }
 async function buildPackage(dir, packagesDir) {
-  const pkg = JSON.parse(readFileSync8(join11(resolve10(dir), "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync8(join11(resolve11(dir), "package.json"), "utf8"));
   return packageKind(pkg) === "library" ? buildLibrary(dir, packagesDir) : buildPlugin(dir, packagesDir);
 }
 
@@ -6619,12 +7217,12 @@ async function run(argv2) {
     const filters = collectFilters(argv2);
     const stampVersion = parseFlag(argv2, "--stamp-version");
     let dir = positionals(argv2, VALUE_FLAGS)[0];
-    const wsRoot = findWorkspaceRoot(dir === void 0 ? process.cwd() : resolve11(dir));
-    const workspaceMode = wsRoot !== null && (dir === void 0 || resolve11(dir) === wsRoot);
+    const wsRoot = findWorkspaceRoot(dir === void 0 ? process.cwd() : resolve12(dir));
+    const workspaceMode = wsRoot !== null && (dir === void 0 || resolve12(dir) === wsRoot);
     if (!workspaceMode && (filters.length > 0 || stampVersion !== void 0)) {
       const flag = filters.length > 0 ? "--filter" : "--stamp-version";
       throw new Error(
-        wsRoot === null ? `${flag} is a workspace flag, but no workspace root was found above ${dir === void 0 ? process.cwd() : resolve11(dir)} \u2014 a workspace root is a package.json carrying an "s2script": { "workspace": { "plugins": [...] } } block` : `${flag} narrows a WORKSPACE build, but ${dir} names a single plugin \u2014 drop the argument (or pass ${wsRoot}) to build the workspace`
+        wsRoot === null ? `${flag} is a workspace flag, but no workspace root was found above ${dir === void 0 ? process.cwd() : resolve12(dir)} \u2014 a workspace root is a package.json carrying an "s2script": { "workspace": { "plugins": [...] } } block` : `${flag} narrows a WORKSPACE build, but ${dir} names a single plugin \u2014 drop the argument (or pass ${wsRoot}) to build the workspace`
       );
     }
     if (wsRoot !== null && workspaceMode) {
@@ -6642,7 +7240,7 @@ async function run(argv2) {
     }
     const packagesDir = resolvePackagesDir({
       explicit: parseFlag(argv2, "--packages-dir"),
-      pluginDir: resolve11(dir),
+      pluginDir: resolve12(dir),
       fromCliUrl: import.meta.url
     });
     const out = await task(`Building ${dir}`, () => buildPackage(dir, packagesDir), {
@@ -6702,11 +7300,11 @@ async function runWorkspace(argv2, root, interactive, filters, stampVersion) {
 }
 
 // src/commands/deploy.ts
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 
 // src/registry/deploy.ts
 import { readFileSync as readFileSync11 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 
 // src/types-pack.ts
 import { readFileSync as readFileSync9 } from "node:fs";
@@ -6770,7 +7368,7 @@ function packTypesTarball(input) {
 }
 
 // src/registry/credentials.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir } from "node:os";
 import { join as join13 } from "node:path";
 function credentialsPath() {
@@ -6806,7 +7404,7 @@ function loadCredentials() {
 }
 function saveCredentials(creds) {
   const dir = join13(homedir(), ".s2script");
-  mkdirSync3(dir, { recursive: true });
+  mkdirSync4(dir, { recursive: true });
   writeFileSync5(
     credentialsPath(),
     JSON.stringify(
@@ -6999,7 +7597,7 @@ function assertDeployable(pkg, label) {
   }
 }
 function assembleDeployArchive(pluginDir, pkg, outPath) {
-  const absDir = resolve12(pluginDir);
+  const absDir = resolve13(pluginDir);
   if (packageKind(pkg) === "library") {
     const lib = readFileSync11(outPath);
     const manifestEntry2 = unzipSync(lib)["manifest.json"];
@@ -7029,8 +7627,8 @@ function assembleDeployArchive(pluginDir, pkg, outPath) {
   return { manifest, s2sp, lib: null, types };
 }
 async function deployPlugin(opts) {
-  const absDir = resolve12(opts.dir);
-  const pkg = JSON.parse(readFileSync11(resolve12(absDir, "package.json"), "utf8"));
+  const absDir = resolve13(opts.dir);
+  const pkg = JSON.parse(readFileSync11(resolve13(absDir, "package.json"), "utf8"));
   assertDeployable(pkg, absDir);
   const creds = loadCredentials();
   if (!creds?.token) {
@@ -7150,9 +7748,9 @@ async function run2(argv2) {
         "--stamp-version is a build-only flag (design spec 2026-07-27 \xA75.4) \u2014 s2s deploy never rewrites versions; run `s2s build --stamp-version <v>` first, then `s2s deploy`"
       );
     }
-    const absDir = resolve13(dir);
+    const absDir = resolve14(dir);
     const root = findWorkspaceRoot(absDir);
-    if (root !== null && resolve13(root) === absDir) {
+    if (root !== null && resolve14(root) === absDir) {
       await runWorkspaceDeploy({ root: absDir, argv: argv2, interactive, filters, dryRun, yes, ci });
       return;
     }
@@ -7279,7 +7877,7 @@ async function runWorkspaceDeploy(opts) {
 }
 
 // src/commands/version.ts
-import { resolve as resolve14 } from "node:path";
+import { resolve as resolve15 } from "node:path";
 
 // src/version/version.ts
 import { existsSync as existsSync10 } from "node:fs";
@@ -7538,7 +8136,7 @@ function resolveVersionRoot(from) {
 async function run3(argv2) {
   const interactive = isInteractive();
   const [dirArg] = positionals(argv2, ["--since"]);
-  const from = resolve14(dirArg ?? ".");
+  const from = resolve15(dirArg ?? ".");
   try {
     const root = resolveVersionRoot(from);
     const result = await task(
@@ -7575,16 +8173,16 @@ async function run3(argv2) {
 }
 
 // src/commands/add.ts
-import { resolve as resolve16 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 
 // src/registry/add.ts
 import {
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   writeFileSync as writeFileSync9,
   readFileSync as readFileSync15,
   existsSync as existsSync12
 } from "node:fs";
-import { join as join19, resolve as resolve15 } from "node:path";
+import { join as join19, resolve as resolve16 } from "node:path";
 import { gunzipSync } from "node:zlib";
 
 // src/registry/npmrc.ts
@@ -7621,14 +8219,14 @@ function ensureScopeNpmrc(projectDir, packageName, registryUrl) {
 }
 
 // src/registry/lib-extract.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join18 } from "node:path";
 var WANTED = /* @__PURE__ */ new Set(["index.js", "index.d.ts"]);
 function extractLibArchive(s2lib, outDir, meta) {
   const entries = unzipSync(new Uint8Array(s2lib));
   if (!entries["index.js"]?.length) throw new Error("library archive missing index.js");
   if (!entries["index.d.ts"]?.length) throw new Error("library archive missing index.d.ts");
-  mkdirSync4(outDir, { recursive: true });
+  mkdirSync5(outDir, { recursive: true });
   for (const [name, bytes] of Object.entries(entries)) {
     if (!WANTED.has(name)) continue;
     writeFileSync8(join18(outDir, name), Buffer.from(bytes));
@@ -7662,7 +8260,7 @@ function parseSpec(spec) {
 }
 function extractTypesTarball(tgz, outDir) {
   const tar = gunzipSync(tgz);
-  mkdirSync5(outDir, { recursive: true });
+  mkdirSync6(outDir, { recursive: true });
   let offset = 0;
   let wroteContract = false;
   while (offset + 512 <= tar.length) {
@@ -7692,7 +8290,7 @@ function rangeForResolved(range, version) {
   return range.startsWith("^") || range === "*" ? `^${major2}.0.0` : range.includes(".") ? range : `^${version}`;
 }
 async function addPackage(opts) {
-  const absDir = resolve15(opts.pluginDir);
+  const absDir = resolve16(opts.pluginDir);
   const { name, range } = parseSpec(opts.spec);
   const creds = loadCredentials();
   const client = new RegistryClient({
@@ -7762,9 +8360,9 @@ async function run4(argv2) {
   }
   try {
     const pluginDir = parseFlag(argv2, "--dir") || ".";
-    const absDir = resolve16(pluginDir);
+    const absDir = resolve17(pluginDir);
     const root = findWorkspaceRoot(absDir);
-    if (root !== null && resolve16(root) === absDir) {
+    if (root !== null && resolve17(root) === absDir) {
       throw new Error(
         `${absDir} is a workspace root (design spec 2026-07-27 \xA74.1), not a plugin \u2014 \`s2s add\` needs a plugin directory: pass --dir <plugin> (e.g. --dir plugins/shop)`
       );
@@ -7811,13 +8409,13 @@ async function run4(argv2) {
 }
 
 // src/commands/install.ts
-import { resolve as resolve18 } from "node:path";
+import { resolve as resolve19 } from "node:path";
 import { existsSync as existsSync14 } from "node:fs";
 
 // src/registry/install.ts
-import { createHash as createHash2 } from "node:crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync10, renameSync, existsSync as existsSync13 } from "node:fs";
-import { basename as basename2, join as join20, resolve as resolve17, sep as sep3 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync16, writeFileSync as writeFileSync10, renameSync, existsSync as existsSync13 } from "node:fs";
+import { basename as basename2, join as join20, resolve as resolve18, sep as sep3 } from "node:path";
 function parseManifest(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
     throw new Error("manifest must be a JSON object");
@@ -7847,7 +8445,7 @@ function mergeSpecs(manifest, args) {
   return merged;
 }
 function sha256Hex(bytes) {
-  return createHash2("sha256").update(bytes).digest("hex");
+  return createHash3("sha256").update(bytes).digest("hex");
 }
 var SAFE_FILENAME_RE = /^[A-Za-z0-9._-]+$/;
 function safeFilename(e) {
@@ -7900,13 +8498,13 @@ async function installPlan(opts) {
       );
     }
   }
-  const dirResolved = resolve17(opts.dir);
+  const dirResolved = resolve18(opts.dir);
   const targets = install.map((e) => {
     if (!e.sha256) {
       throw new Error(`refusing ${e.name}@${e.version}: registry did not provide a sha256 to verify against`);
     }
     const filename = safeFilename(e);
-    const dest = resolve17(join20(opts.dir, filename));
+    const dest = resolve18(join20(opts.dir, filename));
     if (dest !== dirResolved && !dest.startsWith(dirResolved + sep3)) {
       throw new Error(`refusing ${e.name}@${e.version}: destination "${dest}" escapes plugins dir "${dirResolved}"`);
     }
@@ -7917,7 +8515,7 @@ async function installPlan(opts) {
     for (const e of install) log3(`would install ${e.name}@${e.version} -> ${e.filename}`);
     return { written: [], skipped: [], warnings };
   }
-  mkdirSync6(opts.dir, { recursive: true });
+  mkdirSync7(opts.dir, { recursive: true });
   const written = [];
   const skipped = [];
   for (const { entry: e, filename, dest } of targets) {
@@ -7957,7 +8555,7 @@ async function run5(argv2) {
   const reviewedOnly = hasFlag(argv2, "--reviewed-only");
   let dir = parseFlag(argv2, "--dir");
   if (!dir) {
-    if (existsSync14(resolve18(AUTODETECT))) dir = resolve18(AUTODETECT);
+    if (existsSync14(resolve19(AUTODETECT))) dir = resolve19(AUTODETECT);
     else {
       console.error(
         `Usage: s2s install [name[@range]...] --dir <plugins dir>
@@ -7968,7 +8566,7 @@ async function run5(argv2) {
   }
   const client = new RegistryClient({ baseUrl: registry });
   try {
-    const manifest = loadManifestFile(resolve18(file));
+    const manifest = loadManifestFile(resolve19(file));
     const specs = mergeSpecs(manifest, args);
     if (Object.keys(specs).length === 0) {
       console.error(
@@ -7998,22 +8596,22 @@ async function run5(argv2) {
 }
 
 // src/commands/create.ts
-import { resolve as resolve21 } from "node:path";
+import { resolve as resolve22 } from "node:path";
 
 // src/create/create.ts
 import {
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   writeFileSync as writeFileSync11,
   existsSync as existsSync15,
   readdirSync as readdirSync4,
   readFileSync as readFileSync17,
   symlinkSync
 } from "node:fs";
-import { dirname as dirname5, isAbsolute, join as join21, relative as relative2, resolve as resolve19, basename as basename3 } from "node:path";
+import { dirname as dirname6, isAbsolute, join as join21, relative as relative2, resolve as resolve20, basename as basename3 } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function readCliVersion() {
-  const here = dirname5(fileURLToPath2(import.meta.url));
+  const here = dirname6(fileURLToPath2(import.meta.url));
   const candidates = [
     join21(here, "..", "package.json"),
     // dist/cli.js → packages/sdk/package.json
@@ -8031,7 +8629,7 @@ function readCliVersion() {
   return "0.1.0";
 }
 function findLocalPackagesDir() {
-  const here = dirname5(fileURLToPath2(import.meta.url));
+  const here = dirname6(fileURLToPath2(import.meta.url));
   const candidates = [
     join21(here, "..", ".."),
     // dist/cli.js → packages
@@ -8039,12 +8637,12 @@ function findLocalPackagesDir() {
     // src/create → packages
   ];
   for (const c2 of candidates) {
-    if (isPackagesDir(c2)) return resolve19(c2);
+    if (isPackagesDir(c2)) return resolve20(c2);
   }
   return void 0;
 }
 function slugifyBasename(dir, fallback = "plugin") {
-  const base = basename3(resolve19(dir));
+  const base = basename3(resolve20(dir));
   return base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || fallback;
 }
 function defaultNameFromPath(dir, kind = "plugin") {
@@ -8090,10 +8688,10 @@ function versionSpecFrom(status, stdout2) {
   const v = (stdout2 ?? "").trim();
   return status === 0 && /^\d+\.\d+\.\d+/.test(v) ? `^${v}` : "latest";
 }
-function registryDevDeps(game, sdkVersion, resolve22 = resolvePublishedVersion) {
+function registryDevDeps(game, sdkVersion, resolve23 = resolvePublishedVersion) {
   const deps = {};
   for (const n3 of createPackageNames(game)) {
-    deps[`@s2script/${n3}`] = n3 === "sdk" ? `^${sdkVersion}` : resolve22(`@s2script/${n3}`);
+    deps[`@s2script/${n3}`] = n3 === "sdk" ? `^${sdkVersion}` : resolve23(`@s2script/${n3}`);
   }
   return deps;
 }
@@ -8162,7 +8760,7 @@ function tsconfigJson() {
       // `never` — every Engine.call() shows as an error while `s2s build` passes, because the build
       // adds the file to its own program (typecheck.ts) but tsconfig never did. Harmless when the
       // plugin ships no gamedata: the path simply matches nothing.
-      include: ["src", ".s2script/gamedata.d.ts", "node_modules/@s2script/sdk/globals.d.ts"]
+      include: ["src", ".s2script/gamedata.d.ts", ".s2script/interfaces.d.ts", "node_modules/@s2script/sdk/globals.d.ts"]
     },
     null,
     2
@@ -8173,7 +8771,7 @@ function workspaceTsconfigJson(targetPath, workspaceRoot) {
   return JSON.stringify(
     {
       extends: rel.startsWith(".") ? rel : `./${rel}`,
-      include: ["src", ".s2script/gamedata.d.ts", "node_modules/@s2script/sdk/globals.d.ts"]
+      include: ["src", ".s2script/gamedata.d.ts", ".s2script/interfaces.d.ts", "node_modules/@s2script/sdk/globals.d.ts"]
     },
     null,
     2
@@ -8246,7 +8844,7 @@ dist/
 }
 function linkLocalPackagesForNoInstall(targetPath, localPackagesDir) {
   const nm = join21(targetPath, "node_modules");
-  mkdirSync7(nm, { recursive: true });
+  mkdirSync8(nm, { recursive: true });
   const dest = join21(nm, "@s2script");
   if (!existsSync15(dest)) symlinkSync(localPackagesDir, dest);
 }
@@ -8277,7 +8875,7 @@ async function createPlugin(opts = {}) {
     );
   }
   let slug = workspaceRoot !== void 0 && opts.path !== void 0 ? assertBareSlug(opts.path) : opts.path;
-  let targetPath = workspaceRoot === void 0 ? resolve19(opts.path ?? ".") : slug === void 0 ? void 0 : join21(workspaceRoot, "plugins", slug);
+  let targetPath = workspaceRoot === void 0 ? resolve20(opts.path ?? ".") : slug === void 0 ? void 0 : join21(workspaceRoot, "plugins", slug);
   if (targetPath !== void 0) assertEmptyTarget(targetPath);
   if (interactive) {
     intro2("Create an s2script plugin");
@@ -8350,7 +8948,7 @@ async function createPlugin(opts = {}) {
   install = workspaceRoot !== void 0 ? "none" : install ?? (opts.noInstall ? "none" : "npm");
   const finalTargetPath = targetPath;
   const localPackagesDir = workspaceRoot === void 0 ? findLocalPackagesDir() : void 0;
-  mkdirSync7(join21(finalTargetPath, "src"), { recursive: true });
+  mkdirSync8(join21(finalTargetPath, "src"), { recursive: true });
   if (workspaceRoot !== void 0) {
     writeFileSync11(join21(finalTargetPath, "package.json"), minimalPackageJsonContent(name));
     writeFileSync11(
@@ -8407,8 +9005,8 @@ async function createPlugin(opts = {}) {
 }
 
 // src/create/workspace.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join22, resolve as resolve20 } from "node:path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join22, resolve as resolve21 } from "node:path";
 var ROOT_DEFAULT_GAME = "cs2";
 var CHANGESETS_CLI_RANGE = "^2.29.5";
 function defaultWorkspaceName(dir) {
@@ -8461,7 +9059,7 @@ function changesetConfigJson() {
   ) + "\n";
 }
 async function createWorkspace(opts = {}) {
-  const targetPath = resolve20(opts.path ?? ".");
+  const targetPath = resolve21(opts.path ?? ".");
   const interactive = isInteractive({ yes: opts.yes });
   let name = opts.name;
   assertEmptyTarget(targetPath);
@@ -8492,9 +9090,9 @@ async function createWorkspace(opts = {}) {
   name = name ?? defaultWorkspaceName(targetPath);
   const version = readCliVersion();
   const localPackagesDir = findLocalPackagesDir();
-  mkdirSync8(join22(targetPath, "plugins"), { recursive: true });
-  mkdirSync8(join22(targetPath, "packages"), { recursive: true });
-  mkdirSync8(join22(targetPath, ".changeset"), { recursive: true });
+  mkdirSync9(join22(targetPath, "plugins"), { recursive: true });
+  mkdirSync9(join22(targetPath, "packages"), { recursive: true });
+  mkdirSync9(join22(targetPath, ".changeset"), { recursive: true });
   writeFileSync12(join22(targetPath, "package.json"), rootPackageJsonContent(name, version, localPackagesDir));
   writeFileSync12(join22(targetPath, "tsconfig.base.json"), tsconfigBaseJson());
   writeFileSync12(join22(targetPath, "eslint.config.mjs"), eslintConfig());
@@ -8527,7 +9125,7 @@ async function run6(argv2) {
       return;
     }
     const pathArg = positionals(argv2, VALUE_FLAGS2)[0];
-    const workspaceRoot = findWorkspaceRoot(pathArg === void 0 ? process.cwd() : resolve21(pathArg));
+    const workspaceRoot = findWorkspaceRoot(pathArg === void 0 ? process.cwd() : resolve22(pathArg));
     const result = await createPlugin({
       path: pathArg,
       name: parseFlag(argv2, "--name"),
@@ -8735,7 +9333,7 @@ async function run7(argv2) {
 }
 
 // src/config/gen.ts
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, mkdirSync as mkdirSync9 } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, mkdirSync as mkdirSync10 } from "node:fs";
 import { join as join23 } from "node:path";
 
 // src/config/config-path.ts
@@ -8782,7 +9380,7 @@ function genConfigFromManifest(manifest, outDir) {
   }
   const id = typeof manifest.id === "string" ? manifest.id : "";
   if (!id) throw new Error("config gen: manifest declares config but has no id");
-  mkdirSync9(outDir, { recursive: true });
+  mkdirSync10(outDir, { recursive: true });
   const path = join23(outDir, configFileName(id));
   writeFileSync13(path, generateDefaultJsonc(config));
   return path;
@@ -8835,7 +9433,7 @@ async function run8(argv2) {
 }
 
 // src/commands/codegen.ts
-import { dirname as dirname6, join as join28 } from "node:path";
+import { dirname as dirname7, join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/schemagen/gen.ts
@@ -9219,23 +9817,23 @@ function resolveExpr(f) {
   const base = `off(${S(f.declaringClass)},${S(f.rawName)})`;
   return f.addOffset ? `${base} + ${f.addOffset}` : base;
 }
-function accessorEntry(f, resolve22, guard2) {
+function accessorEntry(f, resolve23, guard2) {
   const g = guard2 === "" ? "" : `${guard2} `;
   const gs = guard2 === "" ? "" : `${guard2.replace("return null;", "return;")} `;
   let entry;
   if (f.accessorKind === "str") {
-    entry = `get: function () { ${g}return this.ref.readString(${resolve22}, ${f.strLen}); }`;
+    entry = `get: function () { ${g}return this.ref.readString(${resolve23}, ${f.strLen}); }`;
   } else if (f.accessorKind === "u64" || f.accessorKind === "i64") {
-    entry = `get: function () { ${g}var v = this.ref.${READ[f.accessorKind]}(${resolve22}); return v === null ? null : v.toString(); }`;
+    entry = `get: function () { ${g}var v = this.ref.${READ[f.accessorKind]}(${resolve23}); return v === null ? null : v.toString(); }`;
   } else if (VEC_INFO[f.accessorKind]) {
     const vi = VEC_INFO[f.accessorKind];
-    entry = `get: function () { ${g}var a = this.ref.readFloats(${resolve22}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
+    entry = `get: function () { ${g}var a = this.ref.readFloats(${resolve23}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
   } else {
-    entry = `get: function () { ${g}return this.ref.${READ[f.accessorKind]}(${resolve22}); }`;
+    entry = `get: function () { ${g}return this.ref.${READ[f.accessorKind]}(${resolve23}); }`;
   }
   if (f.writable) {
     const wm = WRITE[f.accessorKind];
-    entry += `, set: function (v) { ${gs}var o = ${resolve22}; if (this.ref.${wm}(o, v)) this.ref.notifyStateChanged(o); }`;
+    entry += `, set: function (v) { ${gs}var o = ${resolve23}; if (this.ref.${wm}(o, v)) this.ref.notifyStateChanged(o); }`;
   }
   return entry;
 }
@@ -9264,9 +9862,9 @@ function emitJs(model) {
     out.push(`  E[${S(e.className)}] = {`);
     for (const f of e.fields) {
       const sub = `off(${S(f.declaringClass)},${S(f.rawName)})`;
-      const resolve22 = f.addOffset ? `this.base + ${sub} + ${f.addOffset}` : `this.base + ${sub}`;
+      const resolve23 = f.addOffset ? `this.base + ${sub} + ${f.addOffset}` : `this.base + ${sub}`;
       const guard2 = `if (this.base < 0 || ${sub} < 0) return null;`;
-      out.push(`    ${S(f.propName)}: { ${accessorEntry(f, resolve22, guard2)} },`);
+      out.push(`    ${S(f.propName)}: { ${accessorEntry(f, resolve23, guard2)} },`);
     }
     for (const f of e.embeddedFields) {
       const sub = `off(${S(f.declaringClass)},${S(f.rawName)})`;
@@ -9570,25 +10168,25 @@ function emitNavJs(model) {
     for (const f of w.fields) {
       const own = `off(${S2(f.declaringClass)},${S2(f.rawName)})`;
       const withDelta = f.addOffset ? `${own} + ${f.addOffset}` : own;
-      const resolve22 = `${withDelta} + this.base`;
+      const resolve23 = `${withDelta} + this.base`;
       let getter;
       const kind = f.accessorKind;
       if (kind === "u64") {
-        getter = `get: function () { var v = this.root.readUInt64Via(this.path, ${resolve22}); return v === null ? null : v.toString(); }`;
+        getter = `get: function () { var v = this.root.readUInt64Via(this.path, ${resolve23}); return v === null ? null : v.toString(); }`;
       } else if (kind === "i64") {
-        getter = `get: function () { var v = this.root.readInt64Via(this.path, ${resolve22}); return v === null ? null : v.toString(); }`;
+        getter = `get: function () { var v = this.root.readInt64Via(this.path, ${resolve23}); return v === null ? null : v.toString(); }`;
       } else if (VEC_INFO[kind]) {
         const vi = VEC_INFO[kind];
-        getter = `get: function () { var a = this.root.readFloatsChain(this.path, ${resolve22}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
+        getter = `get: function () { var a = this.root.readFloatsChain(this.path, ${resolve23}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
       } else if (kind === "handle") {
-        getter = `get: function () { return this.root.readHandleVia(this.path, ${resolve22}); }`;
+        getter = `get: function () { return this.root.readHandleVia(this.path, ${resolve23}); }`;
       } else {
         const method = READ_VIA[kind];
         if (!method) continue;
-        getter = `get: function () { return this.root.${method}(this.path, ${resolve22}); }`;
+        getter = `get: function () { return this.root.${method}(this.path, ${resolve23}); }`;
       }
       const wmethod = f.navWritable ? WRITE_VIA[kind] : void 0;
-      const setter = wmethod ? `, set: function (v) { this.root.${wmethod}(this.path, ${resolve22}, v); }` : "";
+      const setter = wmethod ? `, set: function (v) { this.root.${wmethod}(this.path, ${resolve23}, v); }` : "";
       out.push(`    ${S2(f.propName)}: { ${getter}${setter} },`);
     }
     out.push("  });");
@@ -9742,7 +10340,7 @@ function runGenHooks(repoRoot2, opts) {
 
 // src/commands/codegen.ts
 function repoRoot() {
-  return join28(dirname6(fileURLToPath3(import.meta.url)), "..", "..", "..");
+  return join28(dirname7(fileURLToPath3(import.meta.url)), "..", "..", "..");
 }
 async function run9(kind, argv2) {
   const root = repoRoot();