@s2script/sdk 0.4.0 → 0.5.1

package/dist/cli.js

@@ -4,12 +4,12 @@
 import * as esbuild from "esbuild";
 import AdmZip from "adm-zip";
 import { readFileSync as readFileSync4, mkdirSync } from "node:fs";
-import { resolve as resolve4, join as join4 } from "node:path";
+import { resolve as resolve5, join as join6 } from "node:path";
 
 // src/typecheck/typecheck.ts
 import ts from "typescript";
-import { existsSync as existsSync2, readdirSync, readFileSync, writeFileSync, rmSync, mkdtempSync } from "node:fs";
-import { join as join2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, readdirSync, readFileSync, writeFileSync, rmSync, mkdtempSync } from "node:fs";
+import { join as join3, resolve as resolve2 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/packages-resolve.ts
@@ -55,11 +55,47 @@ function resolvePackagesDir(opts) {
   );
 }
 
+// src/tsconfig-shared.ts
+var sharedCompilerOptionsJson = {
+  strict: true,
+  noEmit: true,
+  moduleResolution: "bundler",
+  module: "ESNext",
+  target: "ES2020",
+  lib: ["ES2020"],
+  types: [],
+  skipLibCheck: true,
+  allowImportingTsExtensions: true
+};
+function sharedProgramOptions(tsMod) {
+  return {
+    strict: sharedCompilerOptionsJson.strict,
+    noEmit: sharedCompilerOptionsJson.noEmit,
+    allowImportingTsExtensions: sharedCompilerOptionsJson.allowImportingTsExtensions,
+    moduleResolution: tsMod.ModuleResolutionKind.Bundler,
+    module: tsMod.ModuleKind.ESNext,
+    target: tsMod.ScriptTarget.ES2020,
+    lib: sharedCompilerOptionsJson.lib.map((l) => `lib.${l.toLowerCase()}.d.ts`),
+    types: [...sharedCompilerOptionsJson.types],
+    skipLibCheck: sharedCompilerOptionsJson.skipLibCheck
+  };
+}
+
+// src/contracts.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+function localContractPath(pluginDir, dep) {
+  const segs = dep.split("/");
+  if (segs.some((s) => s === "" || s === "." || s === "..")) return null;
+  const p = join2(pluginDir, ".s2script", "types", ...segs, "index.d.ts");
+  return existsSync2(p) ? p : null;
+}
+
 // src/typecheck/typecheck.ts
 function localDeclarationFiles(pluginDir) {
-  const srcDir = join2(pluginDir, "src");
-  if (!existsSync2(srcDir)) return [];
-  return readdirSync(srcDir).filter((f) => f.endsWith(".d.ts")).map((f) => join2(srcDir, f));
+  const srcDir = join3(pluginDir, "src");
+  if (!existsSync3(srcDir)) return [];
+  return readdirSync(srcDir).filter((f) => f.endsWith(".d.ts")).map((f) => join3(srcDir, f));
 }
 function declaredModules(dtsFiles) {
   const out = /* @__PURE__ */ new Set();
@@ -72,31 +108,33 @@ function declaredModules(dtsFiles) {
 function typecheckPlugin(pluginDir, opts) {
   const absDir = resolve2(pluginDir);
   const packagesDir = opts?.packagesDir ? resolve2(opts.packagesDir) : resolvePackagesDir({ pluginDir: absDir });
-  const pkg = JSON.parse(readFileSync(join2(absDir, "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync(join3(absDir, "package.json"), "utf8"));
   const s2 = pkg.s2script ?? {};
   const entryRel = s2.main ?? pkg.main;
-  if (!entryRel) throw new Error(`typecheckPlugin: no entry point in ${join2(absDir, "package.json")}`);
+  if (!entryRel) throw new Error(`typecheckPlugin: no entry point in ${join3(absDir, "package.json")}`);
   const entry = resolve2(absDir, entryRel);
   const isAlwaysResolved = (d) => d.startsWith("@s2script/sdk/") || d === "@s2script/cs2" || d.startsWith("@s2script/cs2/");
   const localDts = localDeclarationFiles(absDir);
   const locallyDeclared = declaredModules(localDts);
+  const allDeclaredDeps = [
+    ...Object.keys(s2.pluginDependencies ?? {}),
+    ...Object.keys(s2.optionalPluginDependencies ?? {})
+  ];
+  const contractPaths = {};
+  for (const d of allDeclaredDeps) {
+    const p = localContractPath(absDir, d);
+    if (p !== null) contractPaths[d] = [p];
+  }
   const deps = [
     ...Object.keys(s2.pluginDependencies ?? {}),
     ...Object.keys(s2.optionalPluginDependencies ?? {})
     // Never stub a module the plugin declares itself — a shorthand `declare module "X";` and a
     // full `declare module "X" { … }` for the same X collide.
-  ].filter((d) => !isAlwaysResolved(d) && !locallyDeclared.has(d));
+  ].filter((d) => !isAlwaysResolved(d) && !locallyDeclared.has(d) && contractPaths[d] === void 0);
   const options = {
-    strict: true,
-    noEmit: true,
     // Accept explicit `.ts` import extensions (node type-stripping requires them for source-to-source
     // imports; esbuild strips them at bundle time). Backward-compatible — extensionless imports still resolve.
-    allowImportingTsExtensions: true,
-    moduleResolution: ts.ModuleResolutionKind.Bundler,
-    module: ts.ModuleKind.ESNext,
-    target: ts.ScriptTarget.ES2020,
-    lib: ["lib.es2020.d.ts"],
-    types: [],
+    ...sharedProgramOptions(ts),
     baseUrl: packagesDir,
     paths: {
       // Builtins are `@s2script/sdk/<cap>` → packages/sdk/<cap>.d.ts. The `@s2script/*` fallback
@@ -104,15 +142,15 @@ function typecheckPlugin(pluginDir, opts) {
       // dirs are deleted). tsc picks the longest matching prefix, so `@s2script/sdk/*` wins for
       // sdk imports.
       "@s2script/sdk/*": ["sdk/*.d.ts"],
-      "@s2script/*": ["*/index.d.ts"]
-    },
-    skipLibCheck: true
+      "@s2script/*": ["*/index.d.ts"],
+      ...contractPaths
+    }
   };
-  const rootNames = [entry, join2(packagesDir, "sdk", "globals.d.ts"), ...localDts];
-  const tmp = mkdtempSync(join2(tmpdir(), "s2tc-"));
+  const rootNames = [entry, join3(packagesDir, "sdk", "globals.d.ts"), ...localDts];
+  const tmp = mkdtempSync(join3(tmpdir(), "s2tc-"));
   try {
     if (deps.length) {
-      const stub = join2(tmp, "ambient.d.ts");
+      const stub = join3(tmp, "ambient.d.ts");
       writeFileSync(stub, deps.map((d) => `declare module ${JSON.stringify(d)};`).join("\n") + "\n");
       rootNames.push(stub);
     }
@@ -132,7 +170,7 @@ function typecheckPlugin(pluginDir, opts) {
       }
       return { file, line, col, code: d.code, message: ts.flattenDiagnosticMessageText(d.messageText, "\n") };
     });
-    return { ok: out.length === 0, diagnostics: out };
+    return { ok: out.length === 0, diagnostics: out, program };
   } finally {
     rmSync(tmp, { recursive: true, force: true });
   }
@@ -239,8 +277,8 @@ function validateDecl(full, decl, typeStr, errs) {
 }
 
 // src/publish-gate.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, statSync } from "node:fs";
-import { join as join3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync2, statSync } from "node:fs";
+import { join as join4, resolve as resolve3 } from "node:path";
 function hasPublishes(publishes) {
   if (publishes == null) return false;
   if (typeof publishes === "string") return publishes.trim().length > 0;
@@ -266,7 +304,7 @@ function assertPublishesTypes(pkg, pluginDir) {
     };
   }
   const typesPath = resolve3(pluginDir, typesRel);
-  if (!existsSync3(typesPath)) {
+  if (!existsSync4(typesPath)) {
     return { ok: false, error: `types file not found: ${typesRel}` };
   }
   const st = statSync(typesPath);
@@ -341,32 +379,160 @@ function derivePublishes(authored, pkgName, pkgVersion, typesPath) {
   return out;
 }
 
+// src/api-version.ts
+var HOST_API_VERSION_MAJOR = 2;
+var STAMPED_API_VERSION = `${HOST_API_VERSION_MAJOR}.x`;
+
+// src/publish-scan.ts
+import ts2 from "typescript";
+function isPluginContext(type) {
+  const sym = type.getSymbol() ?? type.aliasSymbol;
+  return sym?.getName() === "PluginContext";
+}
+function scanPluginProgram(program, pluginDir) {
+  const checker = program.getTypeChecker();
+  const out = { publishNames: [], dynamicPublishSites: [], useNames: [] };
+  const dirPrefix = pluginDir.replace(/\\/g, "/").replace(/\/+$/, "") + "/";
+  for (const sf of program.getSourceFiles()) {
+    if (sf.isDeclarationFile) continue;
+    if (!sf.fileName.replace(/\\/g, "/").startsWith(dirPrefix)) continue;
+    const visit = (node) => {
+      if (ts2.isCallExpression(node) && ts2.isPropertyAccessExpression(node.expression)) {
+        const method = node.expression.name.text;
+        if (method === "publish" || method === "use" || method === "tryUse") {
+          const recv = checker.getTypeAtLocation(node.expression.expression);
+          if (isPluginContext(recv)) {
+            const arg0 = node.arguments[0];
+            if (method === "publish") {
+              if (arg0 !== void 0 && ts2.isStringLiteralLike(arg0)) {
+                out.publishNames.push(arg0.text);
+              } else {
+                const { line } = sf.getLineAndCharacterOfPosition(node.getStart());
+                out.dynamicPublishSites.push(`${sf.fileName}:${line + 1}`);
+              }
+            } else if (arg0 !== void 0 && ts2.isStringLiteralLike(arg0)) {
+              out.useNames.push(arg0.text);
+            }
+          }
+        }
+      }
+      ts2.forEachChild(node, visit);
+    };
+    visit(sf);
+  }
+  out.publishNames = [...new Set(out.publishNames)];
+  out.useNames = [...new Set(out.useNames)];
+  return out;
+}
+
+// src/lint/lint.ts
+import { ESLint } from "eslint";
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join5, resolve as resolve4 } from "node:path";
+import s2lint from "@s2script/eslint-plugin";
+var CONFIG_FILES = ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs", "eslint.config.ts"];
+async function lintPlugin(pluginDir, program) {
+  const absDir = resolve4(pluginDir);
+  const hasOwnConfig = CONFIG_FILES.some((f) => existsSync5(join5(absDir, f)));
+  const eslint = hasOwnConfig ? new ESLint({ cwd: absDir, errorOnUnmatchedPattern: false }) : new ESLint({
+    cwd: absDir,
+    overrideConfigFile: true,
+    overrideConfig: s2lint.configs.build([program]),
+    errorOnUnmatchedPattern: false
+  });
+  const dirPrefix = absDir.replace(/\\/g, "/").replace(/\/+$/, "") + "/";
+  const targets = hasOwnConfig ? ["**/*.ts"] : program.getSourceFiles().filter((sf) => !sf.isDeclarationFile && sf.fileName.replace(/\\/g, "/").startsWith(dirPrefix)).map((sf) => sf.fileName);
+  if (targets.length === 0) return { ok: true, output: "", errorCount: 0 };
+  const results = await eslint.lintFiles(targets);
+  const errorCount = results.reduce((n, r) => n + r.errorCount, 0);
+  const formatter = await eslint.loadFormatter("stylish");
+  const output3 = String(await formatter.format(results));
+  return { ok: errorCount === 0, output: output3, errorCount };
+}
+
 // src/build.ts
 async function buildPlugin(dir, packagesDir) {
-  const absDir = resolve4(dir);
-  const pkgPath = join4(absDir, "package.json");
+  const absDir = resolve5(dir);
+  const pkgPath = join6(absDir, "package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
-  const gate = assertPublishesTypes(pkg, absDir);
-  if (!gate.ok) {
-    throw new Error(`publish gate failed: ${gate.error}`);
-  }
   const s2 = pkg.s2script ?? {};
-  const derivedPublishes = derivePublishes(s2.publishes, pkg.name, pkg.version, gate.typesPath);
+  const config = s2.config ?? void 0;
+  if (config !== void 0) {
+    const cfgErrs = validateConfigBlock(config);
+    if (cfgErrs.length) throw new Error(`invalid s2script.config:
+  ${cfgErrs.join("\n  ")}`);
+  }
   const tc = typecheckPlugin(absDir, packagesDir !== void 0 ? { packagesDir } : void 0);
   if (!tc.ok) {
     throw new Error(`typecheck failed (${tc.diagnostics.length} error(s)):
 ${formatDiagnostics(tc.diagnostics)}`);
   }
-  const { name, version } = pkg;
-  const apiVersion = s2.apiVersion ?? "";
+  const scan = scanPluginProgram(tc.program, absDir);
+  const lint = await lintPlugin(absDir, tc.program);
+  if (!lint.ok) {
+    throw new Error(`lint failed (${lint.errorCount} error(s)):
+${lint.output}`);
+  }
+  if (lint.output.trim().length > 0) console.warn(lint.output);
+  if (scan.dynamicPublishSites.length > 0) {
+    throw new Error(
+      `ctx.publish name must be a string literal (the manifest publishes block is derived from code):
+  ` + scan.dynamicPublishSites.join("\n  ")
+    );
+  }
+  let effectivePublishes = s2.publishes;
+  if (!hasPublishes(effectivePublishes)) {
+    if (scan.publishNames.length === 1 && scan.publishNames[0] === pkg.name) {
+      effectivePublishes = "self";
+    } else if (scan.publishNames.length > 0) {
+      throw new Error(
+        `code publishes ${JSON.stringify(scan.publishNames)} but s2script.publishes is missing \u2014 a contract named differently from the package needs an authored entry with a concrete version`
+      );
+    }
+  } else {
+    const authoredNames = Object.keys(expandPublishes(effectivePublishes, pkg.name, pkg.version)).sort();
+    const codeNames = [...scan.publishNames].sort();
+    if (JSON.stringify(authoredNames) !== JSON.stringify(codeNames)) {
+      throw new Error(
+        `publishes drift: package.json declares ${JSON.stringify(authoredNames)} but the code's ctx.publish calls are ${JSON.stringify(codeNames)} \u2014 fix whichever is wrong (the manifest is generated from code; the loader re-verifies at Active)`
+      );
+    }
+  }
+  const gate = assertPublishesTypes({ ...pkg, s2script: { ...s2, publishes: effectivePublishes } }, absDir);
+  if (!gate.ok) {
+    throw new Error(`publish gate failed: ${gate.error}`);
+  }
+  const derivedPublishes = derivePublishes(
+    effectivePublishes,
+    pkg.name,
+    pkg.version,
+    gate.typesPath
+  );
   const pluginDependencies = s2.pluginDependencies ?? {};
   const optionalPluginDependencies = s2.optionalPluginDependencies ?? {};
-  const config = s2.config ?? void 0;
-  if (config !== void 0) {
-    const cfgErrs = validateConfigBlock(config);
-    if (cfgErrs.length) throw new Error(`invalid s2script.config:
-  ${cfgErrs.join("\n  ")}`);
+  const declaredDeps = /* @__PURE__ */ new Set([
+    ...Object.keys(pluginDependencies),
+    ...Object.keys(optionalPluginDependencies)
+  ]);
+  for (const used of scan.useNames) {
+    if (!declaredDeps.has(used)) {
+      console.warn(
+        `WARN: ctx.use/tryUse(${JSON.stringify(used)}) is not declared under s2script.pluginDependencies/optionalPluginDependencies \u2014 it will throw at runtime`
+      );
+    }
   }
+  for (const dep of declaredDeps) {
+    if (!scan.useNames.includes(dep)) {
+      console.warn(`WARN: dependency ${JSON.stringify(dep)} is declared but never ctx.use()d`);
+    }
+  }
+  const { name, version } = pkg;
+  if (s2.apiVersion !== void 0) {
+    console.warn(
+      `WARN: ${pkgPath}: s2script.apiVersion is ignored \u2014 s2s build derives apiVersion from the SDK (stamping ${JSON.stringify(STAMPED_API_VERSION)}). Remove the field.`
+    );
+  }
+  const apiVersion = STAMPED_API_VERSION;
   const external = Array.from(/* @__PURE__ */ new Set([
     "@s2script/*",
     ...Object.keys(pluginDependencies),
@@ -378,7 +544,7 @@ ${formatDiagnostics(tc.diagnostics)}`);
       `buildPlugin: no entry point found in ${pkgPath} (set s2script.main or main)`
     );
   }
-  const entryPoint = join4(absDir, entryRelative);
+  const entryPoint = join6(absDir, entryRelative);
   const result = await esbuild.build({
     entryPoints: [entryPoint],
     bundle: true,
@@ -401,6 +567,15 @@ ${formatDiagnostics(tc.diagnostics)}`);
     manifest.publishes = derivedPublishes;
   }
   if (config !== void 0) manifest.config = config;
+  const compiledAgainst = {};
+  for (const dep of [
+    ...Object.keys(pluginDependencies),
+    ...Object.keys(optionalPluginDependencies)
+  ]) {
+    const contractPath = localContractPath(absDir, dep);
+    if (contractPath !== null) compiledAgainst[dep] = hashContract(contractPath);
+  }
+  if (Object.keys(compiledAgainst).length > 0) manifest.compiledAgainst = compiledAgainst;
   const zip = new AdmZip();
   zip.addFile("manifest.json", Buffer.from(JSON.stringify(manifest, null, 2)));
   zip.addFile("plugin.js", Buffer.from(pluginJs));
@@ -412,16 +587,16 @@ ${formatDiagnostics(tc.diagnostics)}`);
     }
   }
   const sanitizedId = name.replace(/[^a-zA-Z0-9._-]/g, "_");
-  const outDir = join4(absDir, "dist");
+  const outDir = join6(absDir, "dist");
   mkdirSync(outDir, { recursive: true });
-  const outPath = join4(outDir, `${sanitizedId}.s2sp`);
+  const outPath = join6(outDir, `${sanitizedId}.s2sp`);
   zip.writeZip(outPath);
   return outPath;
 }
 
 // src/schemagen/gen.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 
 // src/schemagen/model.ts
 var READ = {
@@ -613,21 +788,21 @@ function emitJs(model) {
   for (const c of model.classes) {
     out.push(`  A[${S(c.className)}] = {`);
     for (const f of flattenedFields(model, c.className)) {
-      const resolve7 = `off(${S(f.declaringClass)},${S(f.rawName)})`;
+      const resolve10 = `off(${S(f.declaringClass)},${S(f.rawName)})`;
       let entry;
       if (f.accessorKind === "str") {
-        entry = `get: function () { return this.ref.readString(${resolve7}, ${f.strLen}); }`;
+        entry = `get: function () { return this.ref.readString(${resolve10}, ${f.strLen}); }`;
       } else if (f.accessorKind === "u64" || f.accessorKind === "i64") {
-        entry = `get: function () { var v = this.ref.${READ[f.accessorKind]}(${resolve7}); return v === null ? null : v.toString(); }`;
+        entry = `get: function () { var v = this.ref.${READ[f.accessorKind]}(${resolve10}); return v === null ? null : v.toString(); }`;
       } else if (VEC_INFO[f.accessorKind]) {
         const vi = VEC_INFO[f.accessorKind];
-        entry = `get: function () { var a = this.ref.readFloats(${resolve7}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
+        entry = `get: function () { var a = this.ref.readFloats(${resolve10}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
       } else {
-        entry = `get: function () { return this.ref.${READ[f.accessorKind]}(${resolve7}); }`;
+        entry = `get: function () { return this.ref.${READ[f.accessorKind]}(${resolve10}); }`;
       }
       if (f.writable) {
         const wm = WRITE[f.accessorKind];
-        entry += `, set: function (v) { var o = ${resolve7}; if (this.ref.${wm}(o, v)) this.ref.notifyStateChanged(o); }`;
+        entry += `, set: function (v) { var o = ${resolve10}; if (this.ref.${wm}(o, v)) this.ref.notifyStateChanged(o); }`;
       }
       out.push(`    ${S(f.propName)}: { ${entry} },`);
     }
@@ -653,8 +828,8 @@ var LIST_PATH = "games/cs2/codegen-classes.json";
 var JS_OUT = "games/cs2/js/schema.generated.js";
 var DTS_OUT = "packages/cs2/schema.generated.d.ts";
 function runGenSchema(repoRoot, opts) {
-  const catalog = JSON.parse(readFileSync5(join5(repoRoot, CATALOG_PATH), "utf8"));
-  const list = JSON.parse(readFileSync5(join5(repoRoot, LIST_PATH), "utf8"));
+  const catalog = JSON.parse(readFileSync5(join7(repoRoot, CATALOG_PATH), "utf8"));
+  const list = JSON.parse(readFileSync5(join7(repoRoot, LIST_PATH), "utf8"));
   const model = buildModel(catalog, list);
   const dts = emitDts(model);
   const js = emitJs(model);
@@ -663,7 +838,7 @@ function runGenSchema(repoRoot, opts) {
   const drift = [];
   const files = [[JS_OUT, js], [DTS_OUT, dts]];
   for (const [rel, content] of files) {
-    const abs = join5(repoRoot, rel);
+    const abs = join7(repoRoot, rel);
     if (opts.check) {
       let cur = "";
       try {
@@ -683,7 +858,7 @@ function runGenSchema(repoRoot, opts) {
 
 // src/eventgen/gen.ts
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join8 } from "node:path";
 
 // src/eventgen/model.ts
 var TYPE_TO_GETTER = {
@@ -768,11 +943,11 @@ function emitEventDts(model) {
 var CATALOG_PATH2 = "games/cs2/gamedata/event-catalog.json";
 var DTS_OUT2 = "packages/cs2/events.generated.d.ts";
 function runGenEvents(repoRoot, opts) {
-  const catalog = JSON.parse(readFileSync6(join6(repoRoot, CATALOG_PATH2), "utf8"));
+  const catalog = JSON.parse(readFileSync6(join8(repoRoot, CATALOG_PATH2), "utf8"));
   const model = buildEventModel(catalog);
   const dts = emitEventDts(model);
   const drift = [];
-  const abs = join6(repoRoot, DTS_OUT2);
+  const abs = join8(repoRoot, DTS_OUT2);
   if (opts.check) {
     let cur = "";
     try {
@@ -788,7 +963,7 @@ function runGenEvents(repoRoot, opts) {
 
 // src/navgen/gen.ts
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/navgen/model.ts
 var SUPPORTED_NAV_KINDS = /* @__PURE__ */ new Set([
@@ -863,22 +1038,22 @@ function emitNavJs(model) {
     out.push(`  function ${w.wrapper}(root, path) { this.root = root; this.path = path; }`);
     out.push(`  Object.defineProperties(${w.wrapper}.prototype, {`);
     for (const f of w.fields) {
-      const resolve7 = `off(${S2(f.declaringClass)},${S2(f.rawName)})`;
+      const resolve10 = `off(${S2(f.declaringClass)},${S2(f.rawName)})`;
       let getter;
       const kind = f.accessorKind;
       if (kind === "u64") {
-        getter = `get: function () { var v = this.root.readUInt64Via(this.path, ${resolve7}); return v === null ? null : v.toString(); }`;
+        getter = `get: function () { var v = this.root.readUInt64Via(this.path, ${resolve10}); return v === null ? null : v.toString(); }`;
       } else if (kind === "i64") {
-        getter = `get: function () { var v = this.root.readInt64Via(this.path, ${resolve7}); return v === null ? null : v.toString(); }`;
+        getter = `get: function () { var v = this.root.readInt64Via(this.path, ${resolve10}); return v === null ? null : v.toString(); }`;
       } else if (VEC_INFO[kind]) {
         const vi = VEC_INFO[kind];
-        getter = `get: function () { var a = this.root.readFloatsChain(this.path, ${resolve7}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
+        getter = `get: function () { var a = this.root.readFloatsChain(this.path, ${resolve10}, ${vi.count}); return a === null ? null : new ${vi.cls}(a[0], a[1], a[2]); }`;
       } else if (kind === "handle") {
-        getter = `get: function () { return this.root.readHandleVia(this.path, ${resolve7}); }`;
+        getter = `get: function () { return this.root.readHandleVia(this.path, ${resolve10}); }`;
       } else {
         const method = READ_VIA[kind];
         if (!method) continue;
-        getter = `get: function () { return this.root.${method}(this.path, ${resolve7}); }`;
+        getter = `get: function () { return this.root.${method}(this.path, ${resolve10}); }`;
       }
       out.push(`    ${S2(f.propName)}: { ${getter} },`);
     }
@@ -950,8 +1125,8 @@ var CATALOG_PATH3 = "games/cs2/gamedata/schema-catalog.json";
 var JS_OUT2 = "games/cs2/js/nav.generated.js";
 var DTS_OUT3 = "packages/cs2/nav.generated.d.ts";
 function runGenNav(repoRoot, opts) {
-  const config = JSON.parse(readFileSync7(join7(repoRoot, TARGETS_PATH), "utf8"));
-  const catalog = JSON.parse(readFileSync7(join7(repoRoot, CATALOG_PATH3), "utf8"));
+  const config = JSON.parse(readFileSync7(join9(repoRoot, TARGETS_PATH), "utf8"));
+  const catalog = JSON.parse(readFileSync7(join9(repoRoot, CATALOG_PATH3), "utf8"));
   const model = buildNavModel(config, catalog);
   const js = emitNavJs(model);
   const dts = emitNavDts(model);
@@ -959,7 +1134,7 @@ function runGenNav(repoRoot, opts) {
   const drift = [];
   const files = [[JS_OUT2, js], [DTS_OUT3, dts]];
   for (const [rel, content] of files) {
-    const abs = join7(repoRoot, rel);
+    const abs = join9(repoRoot, rel);
     if (opts.check) {
       let cur = "";
       try {
@@ -978,11 +1153,12 @@ function runGenNav(repoRoot, opts) {
 import {
   mkdirSync as mkdirSync2,
   writeFileSync as writeFileSync5,
-  existsSync as existsSync4,
+  existsSync as existsSync6,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync8
+  readFileSync as readFileSync8,
+  symlinkSync
 } from "node:fs";
-import { dirname as dirname2, join as join8, resolve as resolve5, basename } from "node:path";
+import { dirname as dirname2, join as join10, resolve as resolve6, basename } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { spawnSync } from "node:child_process";
@@ -990,13 +1166,13 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 function readCliVersion() {
   const here = dirname2(fileURLToPath2(import.meta.url));
   const candidates = [
-    join8(here, "..", "package.json"),
+    join10(here, "..", "package.json"),
     // dist/cli.js → packages/sdk/package.json
-    join8(here, "..", "..", "package.json")
+    join10(here, "..", "..", "package.json")
     // src/create → packages/sdk/package.json
   ];
   for (const p of candidates) {
-    if (!existsSync4(p)) continue;
+    if (!existsSync6(p)) continue;
     try {
       const pkg = JSON.parse(readFileSync8(p, "utf8"));
       if (pkg.name === "@s2script/sdk" && pkg.version) return pkg.version;
@@ -1008,18 +1184,18 @@ function readCliVersion() {
 function findLocalPackagesDir() {
   const here = dirname2(fileURLToPath2(import.meta.url));
   const candidates = [
-    join8(here, "..", ".."),
+    join10(here, "..", ".."),
     // dist/cli.js → packages
-    join8(here, "..", "..", "..")
+    join10(here, "..", "..", "..")
     // src/create → packages
   ];
   for (const c of candidates) {
-    if (isPackagesDir(c)) return resolve5(c);
+    if (isPackagesDir(c)) return resolve6(c);
   }
   return void 0;
 }
 function defaultNameFromPath(dir) {
-  const base = basename(resolve5(dir));
+  const base = basename(resolve6(dir));
   const slug = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "plugin";
   return `@plugin/${slug}`;
 }
@@ -1056,9 +1232,9 @@ function assertInstall(v) {
 }
 function createPackageNames(game) {
   if (game === "cs2") {
-    return ["sdk", "cs2"];
+    return ["sdk", "cs2", "eslint-plugin"];
   }
-  return ["sdk"];
+  return ["sdk", "eslint-plugin"];
 }
 function resolvePublishedVersion(pkg) {
   const r = spawnSync("npm", ["view", pkg, "version"], { encoding: "utf8", timeout: 5e3 });
@@ -1068,68 +1244,62 @@ function versionSpecFrom(status, stdout) {
   const v = (stdout ?? "").trim();
   return status === 0 && /^\d+\.\d+\.\d+/.test(v) ? `^${v}` : "latest";
 }
-function registryDevDeps(game, sdkVersion, resolve7 = resolvePublishedVersion) {
+function registryDevDeps(game, sdkVersion, resolve10 = resolvePublishedVersion) {
   const deps = {};
   for (const n of createPackageNames(game)) {
-    deps[`@s2script/${n}`] = n === "sdk" ? `^${sdkVersion}` : resolve7(`@s2script/${n}`);
+    deps[`@s2script/${n}`] = n === "sdk" ? `^${sdkVersion}` : resolve10(`@s2script/${n}`);
   }
   return deps;
 }
 function fileDevDeps(packagesDir, game) {
   const deps = {};
   for (const n of createPackageNames(game)) {
-    const abs = join8(packagesDir, n);
-    if (!existsSync4(join8(abs, "package.json"))) return void 0;
+    const abs = join10(packagesDir, n);
+    if (!existsSync6(join10(abs, "package.json"))) return void 0;
     deps[`@s2script/${n}`] = `file:${abs}`;
   }
   return deps;
 }
 function pluginSource(game) {
   if (game === "cs2") {
-    return `import { Commands } from "@s2script/sdk/commands";
+    return `import { plugin } from "@s2script/sdk/plugin";
 import { Chat } from "@s2script/sdk/chat";
 
-export function onLoad(): void {
-  Commands.register("hello", (ctx) => {
-    ctx.reply("hello from s2script");
-    if (ctx.callerSlot >= 0) {
-      Chat.toSlot(ctx.callerSlot, "hello from s2script");
+export default plugin((ctx) => {
+  ctx.commands.register("hello", (cmd) => {
+    cmd.reply("hello from s2script");
+    if (cmd.callerSlot >= 0) {
+      Chat.toSlot(cmd.callerSlot, "hello from s2script");
     }
   });
-}
-
-export function onUnload(): void {}
+});
 `;
   }
-  return `import { OnGameFrame } from "@s2script/sdk/frame";
+  return `import { plugin } from "@s2script/sdk/plugin";
 import { delay } from "@s2script/sdk/timers";
 
-export function onLoad(): void {
+export default plugin((ctx) => {
   let n = 0;
-  OnGameFrame.subscribe(() => {
+  ctx.server.onGameFrame(() => {
     n += 1;
   });
-  void delay(1000).then(() => {
-    console.log("s2script plugin alive; frames so far:", n);
-  });
+  void delay(1000).then(() => console.log("s2script plugin alive; frames so far:", n));
+});
+`;
 }
+var ESLINT_RANGE = "^10.7.0";
+function eslintConfig() {
+  return `import s2script from "@s2script/eslint-plugin";
 
-export function onUnload(): void {}
+// The SAME pinned rules \`s2s build\` enforces \u2014 the editor's ESLint extension picks this up,
+// so a violation is a red squiggle before you ever build (green editor => green build).
+export default s2script.configs.recommended({ tsconfigRootDir: import.meta.dirname });
 `;
 }
 function tsconfigJson() {
   return JSON.stringify(
     {
-      compilerOptions: {
-        strict: true,
-        noEmit: true,
-        moduleResolution: "bundler",
-        module: "ESNext",
-        target: "ES2020",
-        lib: ["ES2020"],
-        types: [],
-        skipLibCheck: true
-      },
+      compilerOptions: sharedCompilerOptionsJson,
       include: ["src", "node_modules/@s2script/sdk/globals.d.ts"]
     },
     null,
@@ -1138,7 +1308,10 @@ function tsconfigJson() {
 }
 function packageJsonContent(name, game, version, localPackagesDir) {
   const fileDeps = localPackagesDir ? fileDevDeps(localPackagesDir, game) : void 0;
-  const devDependencies = fileDeps ?? registryDevDeps(game, version);
+  const devDependencies = {
+    ...fileDeps ?? registryDevDeps(game, version),
+    eslint: ESLINT_RANGE
+  };
   return JSON.stringify(
     {
       name,
@@ -1148,10 +1321,7 @@ function packageJsonContent(name, game, version, localPackagesDir) {
       scripts: {
         build: "s2s build ."
       },
-      devDependencies,
-      s2script: {
-        apiVersion: "1.x"
-      }
+      devDependencies
     },
     null,
     2
@@ -1164,6 +1334,12 @@ dist/
 .DS_Store
 `;
 }
+function linkLocalPackagesForNoInstall(targetPath, localPackagesDir) {
+  const nm = join10(targetPath, "node_modules");
+  mkdirSync2(nm, { recursive: true });
+  const dest = join10(nm, "@s2script");
+  if (!existsSync6(dest)) symlinkSync(localPackagesDir, dest);
+}
 function runInstall(dir, pm) {
   if (pm === "none") return;
   const r = spawnSync(pm, ["install"], {
@@ -1175,7 +1351,7 @@ function runInstall(dir, pm) {
   if (r.status !== 0) throw new Error(`${pm} install failed (exit ${r.status})`);
 }
 async function createPlugin(opts = {}) {
-  const targetPath = resolve5(opts.path ?? ".");
+  const targetPath = resolve6(opts.path ?? ".");
   const interactive = Boolean(input.isTTY && output.isTTY && !opts.yes);
   let game = assertGame(opts.game);
   let name = opts.name;
@@ -1184,7 +1360,7 @@ async function createPlugin(opts = {}) {
   if (template !== "minimal") {
     throw new Error(`unknown template ${JSON.stringify(template)} (v1 supports: minimal)`);
   }
-  if (existsSync4(targetPath)) {
+  if (existsSync6(targetPath)) {
     const kids = readdirSync2(targetPath);
     const meaningful = kids.filter((k) => k !== ".git");
     if (meaningful.length) {
@@ -1231,18 +1407,21 @@ async function createPlugin(opts = {}) {
   install = install ?? (opts.noInstall ? "none" : "npm");
   const version = readCliVersion();
   const localPackagesDir = findLocalPackagesDir();
-  mkdirSync2(join8(targetPath, "src"), { recursive: true });
+  mkdirSync2(join10(targetPath, "src"), { recursive: true });
   writeFileSync5(
-    join8(targetPath, "package.json"),
+    join10(targetPath, "package.json"),
     packageJsonContent(name, game, version, localPackagesDir)
   );
-  writeFileSync5(join8(targetPath, "tsconfig.json"), tsconfigJson());
-  writeFileSync5(join8(targetPath, "src", "plugin.ts"), pluginSource(game));
-  writeFileSync5(join8(targetPath, ".gitignore"), gitignore());
+  writeFileSync5(join10(targetPath, "tsconfig.json"), tsconfigJson());
+  writeFileSync5(join10(targetPath, "eslint.config.mjs"), eslintConfig());
+  writeFileSync5(join10(targetPath, "src", "plugin.ts"), pluginSource(game));
+  writeFileSync5(join10(targetPath, ".gitignore"), gitignore());
   let installed = false;
   if (install !== "none") {
     runInstall(targetPath, install);
     installed = true;
+  } else if (localPackagesDir) {
+    linkLocalPackagesForNoInstall(targetPath, localPackagesDir);
   }
   return {
     dir: targetPath,
@@ -1257,7 +1436,7 @@ async function createPlugin(opts = {}) {
 // src/config/gen.ts
 import AdmZip2 from "adm-zip";
 import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join11 } from "node:path";
 
 // src/config/config-path.ts
 function configFileName(id) {
@@ -1272,7 +1451,7 @@ function generateDefaultJsonc(config) {
   return "{\n" + genEntries(config, 1) + "}\n";
 }
 function genEntries(entries, indent) {
-  const pad = "  ".repeat(indent);
+  const pad2 = "  ".repeat(indent);
   const keys = Object.keys(entries).filter((k) => !k.includes(".")).sort();
   let out = "";
   keys.forEach((key, i) => {
@@ -1282,15 +1461,15 @@ function genEntries(entries, indent) {
     const obj = raw;
     if (isDecl(obj)) {
       const desc = typeof obj.description === "string" ? obj.description : "";
-      out += `${pad}// ${String(obj.type)}${desc ? ` \u2014 ${desc}` : ""}
+      out += `${pad2}// ${String(obj.type)}${desc ? ` \u2014 ${desc}` : ""}
 `;
-      out += `${pad}${JSON.stringify(key)}: ${JSON.stringify(obj.default)}${comma}
+      out += `${pad2}${JSON.stringify(key)}: ${JSON.stringify(obj.default)}${comma}
 `;
     } else {
-      out += `${pad}${JSON.stringify(key)}: {
+      out += `${pad2}${JSON.stringify(key)}: {
 `;
       out += genEntries(obj, indent + 1);
-      out += `${pad}}${comma}
+      out += `${pad2}}${comma}
 `;
     }
   });
@@ -1304,7 +1483,7 @@ function genConfigFromManifest(manifest, outDir) {
   const id = typeof manifest.id === "string" ? manifest.id : "";
   if (!id) throw new Error("config gen: manifest declares config but has no id");
   mkdirSync3(outDir, { recursive: true });
-  const path = join9(outDir, configFileName(id));
+  const path = join11(outDir, configFileName(id));
   writeFileSync6(path, generateDefaultJsonc(config));
   return path;
 }
@@ -1326,13 +1505,386 @@ function runConfigGen(s2sps, outDir) {
   return { written, skipped };
 }
 
+// src/registry/login.ts
+import { createInterface as createInterface2 } from "node:readline/promises";
+import { stdin as input2, stdout as output2 } from "node:process";
+
+// src/registry/credentials.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join12 } from "node:path";
+function credentialsPath() {
+  return join12(homedir(), ".s2script", "credentials.json");
+}
+function defaultRegistryUrl() {
+  return process.env.S2SCRIPT_REGISTRY_URL?.replace(/\/$/, "") || "https://s2script.com";
+}
+function loadCredentials() {
+  const fromEnv = process.env.S2SCRIPT_TOKEN || process.env.S2SCRIPT_DEPLOY_TOKEN;
+  if (fromEnv) {
+    return { registryUrl: defaultRegistryUrl(), token: fromEnv };
+  }
+  const p = credentialsPath();
+  if (!existsSync7(p)) return null;
+  try {
+    const j = JSON.parse(readFileSync9(p, "utf8"));
+    if (!j.token) return null;
+    return {
+      registryUrl: (j.registryUrl || defaultRegistryUrl()).replace(/\/$/, ""),
+      token: j.token
+    };
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(creds) {
+  const dir = join12(homedir(), ".s2script");
+  mkdirSync4(dir, { recursive: true });
+  writeFileSync7(
+    credentialsPath(),
+    JSON.stringify(
+      { registryUrl: creds.registryUrl.replace(/\/$/, ""), token: creds.token },
+      null,
+      2
+    ) + "\n",
+    { mode: 384 }
+  );
+}
+
+// src/registry/login.ts
+async function loginInteractive(opts) {
+  const registryUrl = (opts?.registryUrl || defaultRegistryUrl()).replace(/\/$/, "");
+  let token = opts?.token || process.env.S2SCRIPT_TOKEN || process.env.S2SCRIPT_DEPLOY_TOKEN;
+  if (!token) {
+    if (opts?.ci || !input2.isTTY) {
+      throw new Error(
+        "no deploy token: set S2SCRIPT_TOKEN or run `s2script login` interactively"
+      );
+    }
+    const rl = createInterface2({ input: input2, output: output2 });
+    try {
+      console.log(`Registry: ${registryUrl}`);
+      console.log("Create a deploy token at /account/tokens on the registry site, then paste it:");
+      token = (await rl.question("token: ")).trim();
+    } finally {
+      rl.close();
+    }
+  }
+  if (!token || !token.startsWith("s2s_")) {
+    throw new Error('token must start with "s2s_"');
+  }
+  const creds = { registryUrl, token };
+  saveCredentials(creds);
+  return creds;
+}
+
+// src/registry/deploy.ts
+import { readFileSync as readFileSync11 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
+import AdmZip3 from "adm-zip";
+
+// src/types-pack.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+import { gzipSync } from "node:zlib";
+function pad(buf, size) {
+  if (buf.length > size) throw new Error(`tar field overflow (${buf.length}>${size})`);
+  const out = Buffer.alloc(size, 0);
+  buf.copy(out);
+  return out;
+}
+function tarHeader(name, size, type) {
+  const header = Buffer.alloc(512, 0);
+  pad(Buffer.from(name, "utf8"), 100).copy(header, 0);
+  Buffer.from("0000644\0", "utf8").copy(header, 100);
+  Buffer.from("0000000\0", "utf8").copy(header, 108);
+  Buffer.from("0000000\0", "utf8").copy(header, 116);
+  const sizeOct = size.toString(8).padStart(11, "0") + "\0";
+  Buffer.from(sizeOct, "utf8").copy(header, 124);
+  const mtime = Math.floor(Date.now() / 1e3).toString(8).padStart(11, "0") + "\0";
+  Buffer.from(mtime, "utf8").copy(header, 136);
+  Buffer.from("        ", "utf8").copy(header, 148);
+  header[156] = type.charCodeAt(0);
+  Buffer.from("ustar\0", "utf8").copy(header, 257);
+  Buffer.from("00", "utf8").copy(header, 263);
+  let sum = 0;
+  for (let i = 0; i < 512; i++) sum += header[i];
+  const chk = sum.toString(8).padStart(6, "0") + "\0 ";
+  Buffer.from(chk, "utf8").copy(header, 148);
+  return header;
+}
+function tarFile(name, content) {
+  const header = tarHeader(name, content.length, "0");
+  const padLen = (512 - content.length % 512) % 512;
+  return Buffer.concat([header, content, Buffer.alloc(padLen, 0)]);
+}
+function packTypesTarball(input3) {
+  const dts = readFileSync10(input3.typesPath);
+  const pkgJson = Buffer.from(
+    JSON.stringify(
+      {
+        name: input3.name,
+        version: input3.version,
+        types: "api.d.ts",
+        s2script: {
+          kind: "interface",
+          ...input3.publishes ? { publishes: input3.publishes } : {}
+        }
+      },
+      null,
+      2
+    ) + "\n",
+    "utf8"
+  );
+  const tar = Buffer.concat([
+    tarFile("package/package.json", pkgJson),
+    tarFile("package/api.d.ts", dts),
+    Buffer.alloc(1024, 0)
+    // two zero blocks = EOF
+  ]);
+  return gzipSync(tar);
+}
+
+// src/registry/client.ts
+var RegistryError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "RegistryError";
+  }
+};
+var RegistryClient = class {
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+    this.token = opts.token;
+    this.fetchFn = opts.fetch ?? fetch;
+  }
+  headers(extra) {
+    const h = { ...extra ?? {} };
+    if (this.token) h.Authorization = `Bearer ${this.token}`;
+    return h;
+  }
+  async deploy(opts) {
+    const fd = new FormData();
+    fd.set("manifest", JSON.stringify(opts.manifest));
+    fd.set("s2sp", new Blob([new Uint8Array(opts.s2sp)]), "plugin.s2sp");
+    if (opts.types && opts.types.length) {
+      fd.set("types", new Blob([new Uint8Array(opts.types)]), "types.tgz");
+    }
+    const res = await this.fetchFn(`${this.baseUrl}/api/v1/deploy`, {
+      method: "POST",
+      headers: this.headers(),
+      body: fd
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new RegistryError(
+        body.error || `deploy failed (${res.status})`,
+        res.status,
+        body
+      );
+    }
+    return body;
+  }
+  async resolve(name, range = "*") {
+    const u = new URL(`${this.baseUrl}/api/v1/resolve`);
+    u.searchParams.set("name", name);
+    u.searchParams.set("range", range);
+    const res = await this.fetchFn(u, { headers: this.headers() });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new RegistryError(
+        body.message || `resolve failed (${res.status})`,
+        res.status,
+        body
+      );
+    }
+    return body;
+  }
+  async downloadTypes(name, version) {
+    const u = new URL(`${this.baseUrl}/api/v1/download/types`);
+    u.searchParams.set("name", name);
+    u.searchParams.set("version", version);
+    const res = await this.fetchFn(u, { headers: this.headers() });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      throw new RegistryError(
+        body.message || `types download failed (${res.status})`,
+        res.status,
+        body
+      );
+    }
+    return Buffer.from(await res.arrayBuffer());
+  }
+  async meta(name) {
+    const u = new URL(`${this.baseUrl}/api/v1/meta`);
+    u.searchParams.set("name", name);
+    const res = await this.fetchFn(u, { headers: this.headers() });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new RegistryError(`meta failed (${res.status})`, res.status, body);
+    }
+    return body;
+  }
+};
+
+// src/registry/deploy.ts
+async function deployPlugin(opts) {
+  const absDir = resolve7(opts.dir);
+  const pkg = JSON.parse(readFileSync11(resolve7(absDir, "package.json"), "utf8"));
+  const gate = assertPublishesTypes(pkg, absDir);
+  if (!gate.ok) throw new Error(`publish gate failed: ${gate.error}`);
+  const creds = loadCredentials();
+  if (!creds?.token) {
+    throw new Error(
+      opts.ci ? "S2SCRIPT_TOKEN required in CI" : "not logged in \u2014 run `s2s login` or set S2SCRIPT_TOKEN"
+    );
+  }
+  const outPath = await buildPlugin(absDir, opts.packagesDir);
+  const s2sp = readFileSync11(outPath);
+  const zip = new AdmZip3(s2sp);
+  const manifestEntry = zip.getEntry("manifest.json");
+  if (!manifestEntry) {
+    throw new Error(`built archive missing manifest.json: ${outPath}`);
+  }
+  const manifest = JSON.parse(manifestEntry.getData().toString("utf8"));
+  let types = null;
+  if (gate.typesPath) {
+    types = packTypesTarball({
+      name: typeof manifest.id === "string" ? manifest.id : pkg.name,
+      version: typeof manifest.version === "string" ? manifest.version : pkg.version,
+      typesPath: gate.typesPath,
+      publishes: hasPublishes(manifest.publishes) ? manifest.publishes : void 0
+    });
+  }
+  const client = new RegistryClient({
+    baseUrl: opts.registryUrl || creds.registryUrl || defaultRegistryUrl(),
+    token: creds.token
+  });
+  return client.deploy({ manifest, s2sp, types });
+}
+
+// src/registry/add.ts
+import {
+  mkdirSync as mkdirSync5,
+  writeFileSync as writeFileSync9,
+  readFileSync as readFileSync13,
+  existsSync as existsSync9
+} from "node:fs";
+import { join as join14, resolve as resolve8 } from "node:path";
+import { gunzipSync } from "node:zlib";
+
+// src/registry/npmrc.ts
+import { existsSync as existsSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join13 } from "node:path";
+function npmCompatRegistryUrl(registryUrl) {
+  return `${registryUrl.replace(/\/$/, "")}/npm/`;
+}
+function scopeFromPackageName(name) {
+  if (!name.startsWith("@")) return null;
+  const slash = name.indexOf("/");
+  if (slash < 2) return null;
+  return name.slice(1, slash);
+}
+function ensureScopeNpmrc(projectDir, packageName, registryUrl) {
+  const scope = scopeFromPackageName(packageName);
+  if (!scope || scope === "s2script") return null;
+  const compat = npmCompatRegistryUrl(registryUrl);
+  const key = `@${scope}:registry`;
+  const line = `${key}=${compat}`;
+  const npmrcPath = join13(projectDir, ".npmrc");
+  let existing = existsSync8(npmrcPath) ? readFileSync12(npmrcPath, "utf8") : "";
+  const lines = existing.split(/\r?\n/);
+  const idx = lines.findIndex((l) => l.trimStart().startsWith(`${key}=`) || l.trimStart().startsWith(`${key} =`));
+  if (idx >= 0) {
+    lines[idx] = line;
+  } else {
+    if (existing && !existing.endsWith("\n")) lines.push("");
+    lines.push(line);
+  }
+  const out = lines.filter((l, i, a) => !(l === "" && a[i - 1] === "")).join("\n");
+  writeFileSync8(npmrcPath, out.endsWith("\n") ? out : out + "\n");
+  return line;
+}
+
+// src/registry/add.ts
+function parseSpec(spec) {
+  if (spec.startsWith("@")) {
+    const at2 = spec.indexOf("@", 1);
+    if (at2 < 0) return { name: spec, range: "*" };
+    return { name: spec.slice(0, at2), range: spec.slice(at2 + 1) || "*" };
+  }
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return { name: spec, range: "*" };
+  return { name: spec.slice(0, at), range: spec.slice(at + 1) || "*" };
+}
+function extractTypesTarball(tgz, outDir) {
+  const tar = gunzipSync(tgz);
+  mkdirSync5(outDir, { recursive: true });
+  let offset = 0;
+  let wroteContract = false;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    offset += 512;
+    if (header.every((b) => b === 0)) break;
+    const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+    const sizeOct = header.subarray(124, 135).toString("utf8").replace(/\0.*$/, "").trim();
+    const size = parseInt(sizeOct, 8) || 0;
+    const content = tar.subarray(offset, offset + size);
+    offset += size + (512 - size % 512) % 512;
+    if (!name || name.endsWith("/")) continue;
+    const base = name.replace(/^package\//, "");
+    if (base === "package.json") {
+      writeFileSync9(join14(outDir, "package.json"), content);
+    } else if (base === "api.d.ts" || base === "index.d.ts") {
+      writeFileSync9(join14(outDir, "index.d.ts"), content);
+      wroteContract = true;
+    }
+  }
+  if (!wroteContract && !existsSync9(join14(outDir, "index.d.ts"))) {
+    throw new Error("types tarball missing package/api.d.ts (or index.d.ts)");
+  }
+}
+async function addPackage(opts) {
+  const absDir = resolve8(opts.pluginDir);
+  const { name, range } = parseSpec(opts.spec);
+  const creds = loadCredentials();
+  const client = new RegistryClient({
+    baseUrl: opts.registryUrl || creds?.registryUrl || defaultRegistryUrl(),
+    token: creds?.token
+  });
+  const resolved = await client.resolve(name, range);
+  if (!resolved.hasTypes) {
+    throw new Error(`${name}@${resolved.version} has no types artifact (runtime-only package?)`);
+  }
+  const tgz = await client.downloadTypes(name, resolved.version);
+  const typesDir = join14(absDir, ".s2script", "types", ...name.split("/"));
+  extractTypesTarball(tgz, typesDir);
+  const pkgPath = join14(absDir, "package.json");
+  const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
+  pkg.s2script = pkg.s2script ?? {};
+  pkg.s2script.pluginDependencies = pkg.s2script.pluginDependencies ?? {};
+  const major = resolved.version.split(".")[0] ?? "0";
+  pkg.s2script.pluginDependencies[name] = range.startsWith("^") || range === "*" ? `^${major}.0.0` : range.includes(".") ? range : `^${resolved.version}`;
+  writeFileSync9(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  const registryUrl = opts.registryUrl || creds?.registryUrl || defaultRegistryUrl();
+  const npmrcLine = ensureScopeNpmrc(absDir, name, registryUrl);
+  return {
+    name: resolved.name,
+    version: resolved.version,
+    reviewState: resolved.reviewState,
+    typesDir,
+    npmrcLine
+  };
+}
+
 // src/cli.ts
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname3, join as join10, resolve as resolve6 } from "node:path";
+import { dirname as dirname3, join as join15, resolve as resolve9 } from "node:path";
 var argv = process.argv.slice(2);
 var command = argv[0];
 function repoRootFromCli() {
-  return join10(dirname3(fileURLToPath3(import.meta.url)), "..", "..", "..");
+  return join15(dirname3(fileURLToPath3(import.meta.url)), "..", "..", "..");
 }
 function parseFlag(args, name) {
   const eq = args.find((a) => a.startsWith(`${name}=`));
@@ -1421,6 +1973,68 @@ if (command === "gen-schema") {
     console.error(String(e instanceof Error ? e.message : e));
     process.exit(1);
   }
+} else if (command === "login") {
+  const args = argv.slice(1);
+  try {
+    const creds = await loginInteractive({
+      token: parseFlag(args, "--token"),
+      registryUrl: parseFlag(args, "--registry") || defaultRegistryUrl(),
+      ci: hasFlag(args, "--ci")
+    });
+    console.log(`logged in \u2192 ${creds.registryUrl} (credentials saved)`);
+  } catch (e) {
+    console.error(String(e instanceof Error ? e.message : e));
+    process.exit(1);
+  }
+} else if (command === "deploy" || command === "publish") {
+  const args = argv.slice(1);
+  const pos = positionals(args, ["--packages-dir", "--registry"]);
+  const dir = pos[0] ?? ".";
+  try {
+    const packagesDir = resolvePackagesDir({
+      explicit: parseFlag(args, "--packages-dir"),
+      pluginDir: resolve9(dir),
+      fromCliUrl: import.meta.url
+    });
+    const result = await deployPlugin({
+      dir,
+      packagesDir,
+      registryUrl: parseFlag(args, "--registry"),
+      ci: hasFlag(args, "--ci")
+    });
+    console.log(`deployed ${result.name}@${result.version} (${result.reviewState})`);
+    if (result.reviewState === "unreviewed") {
+      console.log("note: Not reviewed by s2script \u2014 listed with a disclaimer until approved.");
+    }
+  } catch (e) {
+    console.error(String(e instanceof Error ? e.message : e));
+    process.exit(1);
+  }
+} else if (command === "add") {
+  const args = argv.slice(1);
+  const pos = positionals(args, ["--dir", "--registry"]);
+  const spec = pos[0];
+  if (!spec) {
+    console.error("Usage: s2s add <pkg>[@range]");
+    process.exit(1);
+  }
+  try {
+    const result = await addPackage({
+      pluginDir: parseFlag(args, "--dir") || ".",
+      spec,
+      registryUrl: parseFlag(args, "--registry")
+    });
+    console.log(`added ${result.name}@${result.version} \u2192 ${result.typesDir}`);
+    if (result.npmrcLine) {
+      console.log(`npmrc: ${result.npmrcLine}  (types-only; npm install ${result.name} also works)`);
+    }
+    if (result.reviewState === "unreviewed") {
+      console.log("note: Not reviewed by s2script \u2014 types pulled; use at your own risk.");
+    }
+  } catch (e) {
+    console.error(String(e instanceof Error ? e.message : e));
+    process.exit(1);
+  }
 } else if (command === "config" && argv[1] === "gen") {
   const args = argv.slice(2);
   const outDir = parseFlag(args, "--out") ?? process.cwd();
@@ -1444,7 +2058,7 @@ if (command === "gen-schema") {
   try {
     const packagesDir = resolvePackagesDir({
       explicit: packagesDirFlag,
-      pluginDir: resolve6(dir),
+      pluginDir: resolve9(dir),
       fromCliUrl: import.meta.url
     });
     console.log(await buildPlugin(dir, packagesDir));
@@ -1454,7 +2068,7 @@ if (command === "gen-schema") {
   }
 } else {
   console.error(
-    "Usage:\n  s2s create [path] [--game cs2|none] [--name <pkg>] [--template minimal]\n             [--install npm|pnpm|yarn|bun|none] [--no-install] [-y]\n  s2s build <dir> [--packages-dir <path>]\n  s2s config gen <plugin.s2sp...> --out <dir>\n  s2s gen-schema [--check]\n  s2s gen-events [--check]\n  s2s gen-nav [--check]"
+    "Usage:\n  s2s create [path] [--game cs2|none] [--name <pkg>] [--template minimal]\n             [--install npm|pnpm|yarn|bun|none] [--no-install] [-y]\n  s2s build <dir> [--packages-dir <path>]\n  s2s login [--token s2s_\u2026] [--registry <url>]\n  s2s deploy [dir] [--ci] [--registry <url>] [--packages-dir <path>]\n  s2s add <pkg>[@range] [--dir <plugin>] [--registry <url>]\n  s2s config gen <plugin.s2sp...> --out <dir>\n  s2s gen-schema [--check]\n  s2s gen-events [--check]\n  s2s gen-nav [--check]\n\nEnv: S2SCRIPT_REGISTRY_URL  S2SCRIPT_TOKEN (CI deploy)"
   );
   process.exit(1);
 }