@s2script/sdk 0.7.0 → 0.8.0

package/chat.d.ts

@@ -11,8 +11,13 @@ export declare const Chat: {
   /**
    * An opaque prefix prepended to every chat message (NOT rcon/console replies). Color is content the
    * caller owns (SourceMod-parity), so the engine-generic layer never picks one. A game/plugin sets this
-   * to a color control byte — e.g. `Chat.color = ChatColors.Green` from `@s2script/cs2`. `""` = send raw
-   * (CS2 needs a leading control byte for chat to render). A message may also embed its own colors.
+   * to a color control byte — e.g. `Chat.color = ChatColors.Green` from `@s2script/cs2`. `""` = no prefix.
+   * A message may also embed its own colors mid-string.
+   *
+   * You do NOT need a leading space for color to render: every chat line is auto-prefixed with an invisible
+   * zero-width space (U+200B) so a Source 2 chat box doesn't swallow the message's first color byte. Just
+   * write `Chat.toSlot(slot, ChatColors.Green + "hi")` — the green lands. (Idempotent: a line you already
+   * lead with a space or a ZWSP is passed through unchanged.)
    */
   color: string;
   /** Print to the chat of the client in `slot` (0-based). */

package/dist/cli.js

@@ -3075,8 +3075,15 @@ import { join as join7 } from "node:path";
 function credentialsPath() {
   return join7(homedir(), ".s2script", "credentials.json");
 }
+function normalizeRegistryUrl(url) {
+  const trimmed = url.replace(/\/$/, "");
+  if (trimmed === "https://s2script.com") return "https://www.s2script.com";
+  return trimmed;
+}
 function defaultRegistryUrl() {
-  return process.env.S2SCRIPT_REGISTRY_URL?.replace(/\/$/, "") || "https://s2script.com";
+  const fromEnv = process.env.S2SCRIPT_REGISTRY_URL;
+  if (fromEnv) return normalizeRegistryUrl(fromEnv);
+  return "https://www.s2script.com";
 }
 function loadCredentials() {
   const fromEnv = process.env.S2SCRIPT_TOKEN || process.env.S2SCRIPT_DEPLOY_TOKEN;
@@ -3089,7 +3096,7 @@ function loadCredentials() {
     const j = JSON.parse(readFileSync6(p, "utf8"));
     if (!j.token) return null;
     return {
-      registryUrl: (j.registryUrl || defaultRegistryUrl()).replace(/\/$/, ""),
+      registryUrl: normalizeRegistryUrl(j.registryUrl || defaultRegistryUrl()),
       token: j.token
     };
   } catch {
@@ -3102,7 +3109,7 @@ function saveCredentials(creds) {
   writeFileSync3(
     credentialsPath(),
     JSON.stringify(
-      { registryUrl: creds.registryUrl.replace(/\/$/, ""), token: creds.token },
+      { registryUrl: normalizeRegistryUrl(creds.registryUrl), token: creds.token },
       null,
       2
     ) + "\n",
@@ -3112,13 +3119,62 @@ function saveCredentials(creds) {
 
 // src/registry/client.ts
 var RegistryError = class extends Error {
+  // Fields are declared/assigned explicitly rather than as constructor parameter
+  // properties: the test runner loads src/*.ts under node's strip-only type
+  // stripping, which rejects `constructor(public status: number)`.
   constructor(message, status, body) {
     super(message);
+    this.name = "RegistryError";
     this.status = status;
     this.body = body;
-    this.name = "RegistryError";
   }
 };
+var TIMEOUTS_MS = {
+  deploy: 3e5,
+  // up to ~40 MiB on a slow uplink
+  resolve: 3e4,
+  meta: 3e4,
+  "types download": 12e4
+};
+function rootCause(err2) {
+  let cur = err2;
+  for (let i2 = 0; i2 < 5 && cur instanceof Error && cur.cause; i2++) cur = cur.cause;
+  return cur instanceof Error ? cur.message : String(cur);
+}
+function hintFor(status, raw) {
+  if (status === 401) return "run `s2s login` (or set S2SCRIPT_TOKEN)";
+  if (status === 403 && /cross-site/i.test(raw)) {
+    return "the request was rejected before it reached the registry API \u2014 this s2s CLI and the server are incompatible; run: npm i -g @s2script/sdk@latest";
+  }
+  if (status === 403) return "the token may lack permission for this package, or belong to another account \u2014 check `s2s login`";
+  if (status === 413) return "the plugin or its types exceed the registry size limits \u2014 trim the archive and retry";
+  if (status === 415) return "the server rejected this CLI's request format; run: npm i -g @s2script/sdk@latest";
+  if (status === 429) return "rate limited \u2014 wait a minute and retry";
+  if (status >= 500) return "server-side failure \u2014 retry in a moment; if it persists, report it with the message above";
+  return "";
+}
+async function errorFromResponse(res, op) {
+  const raw = await res.text().catch(() => "");
+  let body;
+  let detail;
+  try {
+    body = JSON.parse(raw);
+    const b = body;
+    if (b && typeof b.error === "string") detail = b.error;
+    else if (b && typeof b.message === "string") detail = b.message;
+  } catch {
+  }
+  if (!detail) {
+    if (/^\s*</.test(raw)) detail = "server returned an HTML error page";
+    else if (raw.trim()) detail = raw.trim().slice(0, 200);
+    else detail = res.statusText || "no response body";
+  }
+  let msg = `${op} failed (HTTP ${res.status}): ${detail}`;
+  const hint = hintFor(res.status, raw);
+  if (hint) msg += `
+  hint: ${hint}`;
+  return new RegistryError(msg, res.status, body ?? raw);
+}
 var RegistryClient = class {
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/$/, "");
@@ -3130,67 +3186,80 @@ var RegistryClient = class {
     if (this.token) h2.Authorization = `Bearer ${this.token}`;
     return h2;
   }
+  async request(op, url, init) {
+    const timeoutMs = TIMEOUTS_MS[op];
+    const host = new URL(String(url)).host;
+    let res;
+    try {
+      res = await this.fetchFn(url, {
+        method: init?.method ?? "GET",
+        // Cast: a Uint8Array is a valid BodyInit at runtime, but the ambient
+        // fetch typings here only accept ArrayBuffer-backed views.
+        body: init?.body,
+        headers: this.headers(init?.contentType ? { "content-type": init.contentType } : void 0),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (e) {
+      const name = e instanceof Error ? e.name : "";
+      if (name === "TimeoutError" || name === "AbortError") {
+        throw new RegistryError(
+          `${op}: timed out after ${timeoutMs / 1e3}s talking to ${host}
+  hint: check your connection or set S2SCRIPT_REGISTRY_URL if you meant a different registry`,
+          0
+        );
+      }
+      throw new RegistryError(
+        `${op}: network error talking to ${host} \u2014 ${rootCause(e)}
+  hint: check your connection, proxy, and that ${host} is reachable`,
+        0,
+        e
+      );
+    }
+    if (!res.ok) throw await errorFromResponse(res, op);
+    return res;
+  }
+  async json(res, op) {
+    try {
+      return await res.json();
+    } catch {
+      throw new RegistryError(`${op}: server returned invalid JSON (HTTP ${res.status})`, res.status);
+    }
+  }
   async deploy(opts) {
-    const fd2 = new FormData();
-    fd2.set("manifest", JSON.stringify(opts.manifest));
-    fd2.set("s2sp", new Blob([new Uint8Array(opts.s2sp)]), "plugin.s2sp");
+    const entries = {
+      "manifest.json": new TextEncoder().encode(JSON.stringify(opts.manifest)),
+      "plugin.s2sp": new Uint8Array(opts.s2sp)
+    };
     if (opts.types && opts.types.length) {
-      fd2.set("types", new Blob([new Uint8Array(opts.types)]), "types.tgz");
+      entries["types.tgz"] = new Uint8Array(opts.types);
     }
-    const res = await this.fetchFn(`${this.baseUrl}/api/v1/deploy`, {
+    const body = zipSync(entries, { level: 0 });
+    const res = await this.request("deploy", `${this.baseUrl}/api/v1/deploy`, {
       method: "POST",
-      headers: this.headers(),
-      body: fd2
+      body,
+      contentType: "application/octet-stream"
     });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      throw new RegistryError(
-        body.error || `deploy failed (${res.status})`,
-        res.status,
-        body
-      );
-    }
-    return body;
+    return this.json(res, "deploy");
   }
   async resolve(name, range = "*") {
     const u4 = new URL(`${this.baseUrl}/api/v1/resolve`);
     u4.searchParams.set("name", name);
     u4.searchParams.set("range", range);
-    const res = await this.fetchFn(u4, { headers: this.headers() });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      throw new RegistryError(
-        body.message || `resolve failed (${res.status})`,
-        res.status,
-        body
-      );
-    }
-    return body;
+    const res = await this.request("resolve", u4);
+    return this.json(res, "resolve");
   }
   async downloadTypes(name, version) {
     const u4 = new URL(`${this.baseUrl}/api/v1/download/types`);
     u4.searchParams.set("name", name);
     u4.searchParams.set("version", version);
-    const res = await this.fetchFn(u4, { headers: this.headers() });
-    if (!res.ok) {
-      const body = await res.json().catch(() => ({}));
-      throw new RegistryError(
-        body.message || `types download failed (${res.status})`,
-        res.status,
-        body
-      );
-    }
+    const res = await this.request("types download", u4);
     return Buffer.from(await res.arrayBuffer());
   }
   async meta(name) {
     const u4 = new URL(`${this.baseUrl}/api/v1/meta`);
     u4.searchParams.set("name", name);
-    const res = await this.fetchFn(u4, { headers: this.headers() });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      throw new RegistryError(`meta failed (${res.status})`, res.status, body);
-    }
-    return body;
+    const res = await this.request("meta", u4);
+    return this.json(res, "meta");
   }
 };
 
@@ -3724,26 +3793,158 @@ async function run4(argv2) {
   }
 }
 
+// src/registry/login.ts
+import { hostname } from "node:os";
+
+// src/registry/device-flow.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+function rootCause2(err2) {
+  let cur = err2;
+  for (let i2 = 0; i2 < 5 && cur instanceof Error && cur.cause; i2++) cur = cur.cause;
+  return cur instanceof Error ? cur.message : String(cur);
+}
+async function describeError(res) {
+  const raw = await res.text().catch(() => "");
+  try {
+    const body = JSON.parse(raw);
+    if (body && typeof body.error === "string") return body.error;
+    if (body && typeof body.message === "string") return body.message;
+  } catch {
+  }
+  if (/^\s*</.test(raw)) return "server returned an HTML error page";
+  if (raw.trim()) return raw.trim().slice(0, 200);
+  return res.statusText || "no response body";
+}
+async function startDeviceAuth(registryUrl, opts) {
+  const fetchFn = opts?.fetchFn ?? fetch;
+  let res;
+  try {
+    res = await fetchFn(`${registryUrl}/api/v1/auth/device/start`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ client: opts?.client }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  } catch (e) {
+    throw new Error(`could not reach ${registryUrl} \u2014 ${rootCause2(e)}`);
+  }
+  if (res.status === 404 || res.status === 405) return null;
+  if (!res.ok) {
+    throw new Error(`login start failed (HTTP ${res.status}): ${await describeError(res)}`);
+  }
+  const body = await res.json().catch(() => null);
+  if (!body || typeof body.deviceCode !== "string" || typeof body.userCode !== "string") {
+    throw new Error(`login start returned an unexpected response from ${registryUrl}`);
+  }
+  return body;
+}
+async function pollForToken(registryUrl, start, opts) {
+  const fetchFn = opts?.fetchFn ?? fetch;
+  const sleep = opts?.sleep ?? ((ms) => new Promise((r2) => setTimeout(r2, ms)));
+  let interval = Math.max(1, start.interval);
+  const deadline = Date.now() + start.expiresIn * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let res;
+    try {
+      res = await fetchFn(`${registryUrl}/api/v1/auth/device/poll`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceCode: start.deviceCode }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+    } catch (e) {
+      throw new Error(`could not reach ${registryUrl} \u2014 ${rootCause2(e)}`);
+    }
+    if (!res.ok) {
+      throw new Error(`login poll failed (HTTP ${res.status}): ${await describeError(res)}`);
+    }
+    const body = await res.json().catch(() => null);
+    if (!body) throw new Error("login poll returned a non-JSON response");
+    switch (body.status) {
+      case "pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "approved":
+        if (!body.token) throw new Error("server approved the login but sent no token");
+        return { token: body.token, tokenName: body.tokenName };
+      case "denied":
+        throw new Error("login request was denied in the browser");
+      case "expired":
+        throw new Error("login request expired \u2014 run `s2s login` again");
+      default:
+        throw new Error(`unexpected login status: ${body.status}`);
+    }
+  }
+  throw new Error("login request expired \u2014 run `s2s login` again");
+}
+
+// src/registry/open-browser.ts
+import { spawn } from "node:child_process";
+function tryOpenBrowser(url) {
+  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+    return false;
+  }
+  let cmd;
+  let args;
+  if (process.platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    cmd = "cmd";
+    args = ["/c", "start", '""', url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/registry/login.ts
 async function loginInteractive(opts) {
-  const registryUrl = (opts?.registryUrl || defaultRegistryUrl()).replace(/\/$/, "");
+  const registryUrl = normalizeRegistryUrl(opts?.registryUrl || defaultRegistryUrl());
   let token = opts?.token || process.env.S2SCRIPT_TOKEN || process.env.S2SCRIPT_DEPLOY_TOKEN;
   if (!token) {
     if (!isInteractive({ ci: opts?.ci })) {
-      throw new Error(
-        "no deploy token: set S2SCRIPT_TOKEN or run `s2s login` interactively"
-      );
+      throw new Error("no deploy token: set S2SCRIPT_TOKEN or run `s2s login` interactively");
     }
     intro2("s2script login");
     log2.info(`Registry: ${registryUrl}`);
-    log2.info(
-      `Sign in (or create an account), then mint a deploy token at:
+    const start = await startDeviceAuth(registryUrl, { client: hostname() });
+    if (start) {
+      log2.info(`Confirmation code: ${start.userCode}`);
+      log2.info(`Approve at: ${start.verificationUriComplete}`);
+      if (!opts?.noBrowser && tryOpenBrowser(start.verificationUriComplete)) {
+        log2.info("Opened your browser \u2014 approve the request there.");
+      } else {
+        log2.info("Open that link in any browser (it can be on another machine).");
+      }
+      const approved = await task(
+        "Waiting for approval in the browser\u2026",
+        () => pollForToken(registryUrl, start),
+        { interactive: true, done: (r2) => `Approved (token "${r2.tokenName ?? "cli"}")` }
+      );
+      token = approved.token;
+    } else {
+      log2.info(
+        `Sign in (or create an account), then mint a deploy token at:
   ${registryUrl}/account/tokens`
-    );
-    token = (await password2({
-      message: "Paste your deploy token",
-      validate: (v) => (v ?? "").trim().startsWith("s2s_") ? void 0 : 'token must start with "s2s_"'
-    })).trim();
+      );
+      token = (await password2({
+        message: "Paste your deploy token",
+        validate: (v) => (v ?? "").trim().startsWith("s2s_") ? void 0 : 'token must start with "s2s_"'
+      })).trim();
+    }
   }
   if (!token || !token.startsWith("s2s_")) {
     throw new Error('token must start with "s2s_"');
@@ -3760,7 +3961,8 @@ async function run5(argv2) {
     const creds = await loginInteractive({
       token: parseFlag(argv2, "--token"),
       registryUrl: parseFlag(argv2, "--registry") || defaultRegistryUrl(),
-      ci: hasFlag(argv2, "--ci")
+      ci: hasFlag(argv2, "--ci"),
+      noBrowser: hasFlag(argv2, "--no-browser")
     });
     const msg = `logged in \u2192 ${creds.registryUrl} (credentials saved)`;
     if (interactive) outro2(msg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@s2script/sdk",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "license": "MIT OR Apache-2.0",
   "description": "s2script SDK — the builtin capability types (imported as @s2script/sdk/entity, …) plus the `s2s` CLI for building Source 2 / CS2 plugins.",
   "type": "module",