Publishing to the registry

Community plugins ship through the s2script registry on this site: one identity, one version, dual artifacts (.s2sp for operators + types tarball for authors). Publish is open; review is additive — new versions start unreviewed with a public disclaimer.

The CLI is s2s, shipped in @s2script/sdk. Use s2s … when the package is installed, or npx @s2script/sdk … otherwise.

Prerequisites

1. Create an account at /signup
2. Claim a scope under Organizations (e.g. @acme) — one scope per org
3. Authorize the CLI (CLI login) or mint a deploy token

Unscoped names (rtv) are owned by the first user who deploys them — no org required.

Authenticate

Local (device login)

s2s login
# or: npx @s2script/sdk login

The CLI calls POST /api/v1/auth/device/code, prints a short code, and opens /cli/authorize. Approve in the browser; the CLI receives a s2s_… deploy token and stores it in ~/.s2script/credentials.json.

Paste path (headless boxes):

s2s login --token s2s_…

CI

env:
  S2SCRIPT_TOKEN: ${{ secrets.S2SCRIPT_TOKEN }}
run: npx @s2script/sdk deploy --ci

--ci never prompts; missing S2SCRIPT_TOKEN exits non-zero.

package.json

{
	"name": "@edge/heal-zones",
	"version": "1.0.0",
	"types": "api.d.ts",
	"s2script": {
		"apiVersion": "1.x",
		"publishes": { "@edge/heal-zones": "1.0.0" },
		"pluginDependencies": { "@s2script/cs2": "^1.0.0" }
	}
}

If s2script.publishes is set, "types" must point at an existing .d.ts. The CLI packs that file into a types-only tarball; the registry rejects uploads that omit it (400 publishes_requires_types). Runtime-only plugins omit publishes and skip types.

Deploy

s2s deploy

1. Runs the publishes ⇒ types gate
2. Builds the .s2sp
3. Packs types when needed
4. POST /api/v1/deploy with Authorization: Bearer s2s_… (multipart: manifest, s2sp, optional types)

Success returns { name, version, reviewState: "unreviewed" }. Manage versions, yank, and descriptions from the publisher dashboard.

Operator & author consumers

Types are also available via the npm-compatible surface at /npm/* (never serves .s2sp).

Yank

From the dashboard, or:

curl -X POST https://s2script.com/api/v1/yank 
  -H "Authorization: Bearer $S2SCRIPT_TOKEN" 
  -H "Content-Type: application/json" 
  -d '{"name":"@edge/heal-zones","version":"1.0.0"}'

Yanked versions are hidden from default resolve; lockfile pins can still warn.

Reserved

@s2script/* is first-party only. Community tokens cannot deploy into that scope.

Next

• Authoring plugins — scaffold, build, plugin shape
• Inter-plugin interfaces — publishes / ctx.use
• Plugin catalog — public package pages + disclaimer