diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c218f55
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,106 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [master, develop]
+  push:
+    branches: [master, develop]
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    name: Checks (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: "1.25.x"
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+          cache: pnpm
+
+      - name: Install pnpm
+        run: npm install --global pnpm@10.33.0
+
+      - name: Install Node dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check package versions
+        run: pnpm version:check
+
+      - name: Run Node tests
+        run: pnpm test
+
+      - name: Run Go tests without skips
+        run: pnpm test:go
+
+      - name: Run Go vet
+        run: go vet ./...
+
+  quality:
+    name: Format and vulnerability checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: "1.25.x"
+
+      - name: Check Go formatting
+        run: test -z "$(gofmt -l $(git ls-files '*.go'))"
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
+
+      - name: Run govulncheck
+        run: govulncheck ./...
+
+  npm-smoke:
+    name: npm tarball smoke test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: "1.25.x"
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+
+      - name: Build binaries
+        run: bash scripts/build-all.sh v2.0.0-smoke
+
+      - name: Prepare platform packages
+        run: bash scripts/prepare-npm-packages.sh build
+
+      - name: Pack npm packages
+        run: |
+          mkdir -p dist/npm
+          npm pack --pack-destination dist/npm
+          for package_dir in npm/linux-x64 npm/linux-arm64 npm/darwin-x64 npm/darwin-arm64 npm/win32-x64; do
+            npm pack "./$package_dir" --pack-destination dist/npm
+          done
+
+      - name: Smoke test npm tarballs
+        run: npm run test:npm-smoke
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f651cbc..c9c2fbe 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -9,81 +9,73 @@ permissions:
   contents: write
   id-token: write
 
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
-  pipeline:
-    name: Build (${{ matrix.goos }}-${{ matrix.goarch }})
+  publish:
+    name: Build and publish
     runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        include:
-          - goos: linux
-            goarch: amd64
-            artifact: opencore-linux-amd64
-            isPublisher: false
-
-          - goos: darwin
-            goarch: amd64
-            artifact: opencore-darwin-amd64
-            isPublisher: false
-
-          - goos: darwin
-            goarch: arm64
-            artifact: opencore-darwin-arm64
-            isPublisher: false
-
-          - goos: windows
-            goarch: amd64
-            artifact: opencore-windows-amd64.exe
-            isPublisher: true
-
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: "1.24.5"
+          go-version: "1.25.x"
 
-      - name: Go tests
-        if: ${{ matrix.isPublisher }}
-        run: go test ./...
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          cache: pnpm
 
-      - name: Build binary
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-          CGO_ENABLED: 0
+      - name: Install pnpm
+        run: npm install --global pnpm@10.33.0
+
+      - name: Install Node dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify tag is on a release branch
         run: |
-          go build -ldflags "-X main.version=${{ github.ref_name }}" -o "${{ matrix.artifact }}" .
+          git fetch origin develop master
+          if git merge-base --is-ancestor "$GITHUB_SHA" origin/develop || git merge-base --is-ancestor "$GITHUB_SHA" origin/master; then
+            exit 0
+          fi
+          echo "Tag commit $GITHUB_SHA is not contained in develop or master."
+          exit 1
 
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.artifact }}
-          path: ${{ matrix.artifact }}
+      - name: Run release preflight
+        run: pnpm release:check -- "${{ github.ref_name }}"
 
-      - name: Setup Node
-        if: ${{ matrix.isPublisher }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24"
+      - name: Build binaries
+        run: bash scripts/build-all.sh "${{ github.ref_name }}"
+
+      - name: Prepare platform packages
+        run: bash scripts/prepare-npm-packages.sh build
 
-      - name: Update package version
-        if: ${{ matrix.isPublisher }}
-        shell: bash
+      - name: Pack npm packages
         run: |
-          VERSION=${GITHUB_REF#refs/tags/v}
-          npm version "$VERSION" --no-git-tag-version --allow-same-version
+          mkdir -p dist/npm
+          npm pack --pack-destination dist/npm
+          for package_dir in npm/linux-x64 npm/linux-arm64 npm/darwin-x64 npm/darwin-arm64 npm/win32-x64; do
+            npm pack "./$package_dir" --pack-destination dist/npm
+          done
+
+      - name: Smoke test npm tarballs
+        run: pnpm test:npm-smoke
 
       - name: Resolve release channel
-        if: ${{ matrix.isPublisher }}
         id: channel
-        shell: bash
+        env:
+          VERSION: ${{ github.ref_name }}
         run: |
-          VERSION=${GITHUB_REF#refs/tags/v}
-          if [[ "$VERSION" == *-* ]]; then
+          if [[ "${VERSION}" == *-* ]]; then
             echo "channel=beta" >> "$GITHUB_OUTPUT"
             echo "prerelease=true" >> "$GITHUB_OUTPUT"
           else
@@ -91,34 +83,33 @@ jobs:
             echo "prerelease=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Publish to NPM (Trusted Publisher)
-        if: ${{ matrix.isPublisher }}
+      - name: Publish packages idempotently
         env:
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-        run: npm publish --access public --provenance --tag "${{ steps.channel.outputs.channel }}"
-
-      - name: Download all artifacts
-        if: ${{ matrix.isPublisher }}
-        uses: actions/download-artifact@v4
-        with:
-          path: ./artifacts
-
-      - name: Prepare release assets
-        if: ${{ matrix.isPublisher }}
-        shell: bash
+          CHANNEL: ${{ steps.channel.outputs.channel }}
+          VERSION: ${{ github.ref_name }}
         run: |
-          mkdir -p release
-          find ./artifacts -type f -maxdepth 2 -exec cp {} ./release/ \;
-          ls -lah ./release/
+          version=${VERSION#v}
+          publish_if_missing() {
+            package_dir=$1
+            package_name=$(node -p "require('./${package_dir}/package.json').name")
+            if npm view "${package_name}@${version}" version >/dev/null 2>&1; then
+              echo "${package_name}@${version} is already published."
+            else
+              (cd "$package_dir" && npm publish --access public --provenance --tag "$CHANNEL")
+            fi
+          }
+          for package_dir in npm/linux-x64 npm/linux-arm64 npm/darwin-x64 npm/darwin-arm64 npm/win32-x64; do
+            publish_if_missing "$package_dir"
+          done
+          publish_if_missing .
+
+      - name: Generate checksums
+        run: (cd build && sha256sum opencore-* > SHA256SUMS)
 
       - name: Create GitHub Release
-        if: ${{ matrix.isPublisher }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
-          files: ./release/*
+          files: build/*
           draft: false
           prerelease: ${{ steps.channel.outputs.prerelease }}
           body_path: RELEASE.md
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 0678082..3f5bbce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,8 +4,8 @@
 *.dll
 *.so
 *.dylib
-opencore
-opencore-*
+/opencore
+/opencore-*
 !scripts/*.sh
 
 # Test binary
@@ -34,4 +34,3 @@ Thumbs.db
 # NPM
 node_modules/
 npm/*.tgz
-pnpm-lock.yaml
\ No newline at end of file
diff --git a/.golangci.yml b/.golangci.yml
index 6d45665..30b776b 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,22 +1,25 @@
+version: "2"
+
 linters:
   enable:
     - errcheck
-    - gosimple
     - govet
     - ineffassign
     - staticcheck
     - unused
+  exclusions:
+    rules:
+      - path: _test\.go
+        linters:
+          - errcheck
+
+formatters:
+  enable:
     - gofmt
     - goimports
-
-linters-settings:
-  gofmt:
-    simplify: true
-  goimports:
-    local-prefixes: github.com/newcore-network/opencore-cli
-
-issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
+  settings:
+    gofmt:
+      simplify: true
+    goimports:
+      local-prefixes:
+        - github.com/newcore-network/opencore-cli
diff --git a/Makefile b/Makefile
index 70ca81c..c8a7f4d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build build-all clean install test
+.PHONY: build build-all clean install test lint deps
 
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS := -ldflags "-X main.version=$(VERSION)"
@@ -9,10 +9,12 @@ build:
 
 # Build for all platforms
 build-all: clean
+	mkdir -p build
 	GOOS=windows GOARCH=amd64 go build $(LDFLAGS) -o build/opencore-windows-amd64.exe .
 	GOOS=darwin GOARCH=amd64 go build $(LDFLAGS) -o build/opencore-darwin-amd64 .
 	GOOS=darwin GOARCH=arm64 go build $(LDFLAGS) -o build/opencore-darwin-arm64 .
 	GOOS=linux GOARCH=amd64 go build $(LDFLAGS) -o build/opencore-linux-amd64 .
+	GOOS=linux GOARCH=arm64 go build $(LDFLAGS) -o build/opencore-linux-arm64 .
 
 # Clean build artifacts
 clean:
@@ -35,4 +37,3 @@ lint:
 deps:
 	go mod download
 	go mod tidy
-
diff --git a/README.md b/README.md
index ad3d090..74066b1 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,23 @@ This may be outdated, the latest information is recommended at [opencorejs.dev](
 npm install -g @open-core/cli
 ```
 
+The CLI can also be installed with pnpm or Yarn Classic:
+
+```bash
+pnpm add -g @open-core/cli
+yarn global add @open-core/cli
+```
+
+Run without installing globally:
+
+```bash
+npx @open-core/cli
+```
+
+The npm package installs a prebuilt binary for the current platform. It does
+not run installation scripts or download binaries after npm has installed the
+packages. GitHub Releases remain available for manual downloads.
+
 ### Go
 
 ```bash
@@ -72,7 +89,7 @@ go build -o opencore .
 | `opencore clone <template>` | Clone an official template |
 | `opencore dev` | Start development mode with file watching |
 | `opencore doctor` | Validate project configuration |
-| `opencore update` | self-update CLI |
+| `opencore update` | Update the CLI through npm, pnpm, or Yarn |
 | `opencore --version` | Display CLI version |
 | `opencore --h` | Help |
 
@@ -86,26 +103,45 @@ For CI runners (for example GitHub Actions) and non-interactive shells, use plai
 opencore build --output=plain
 ```
 
-You can also disable automatic update checks in CI logs:
+For npm installations, use dist-tags directly:
 
 ```bash
-OPENCORE_DISABLE_UPDATE_CHECK=1 opencore build --output=plain
+npm install -g @open-core/cli
+npm install -g @open-core/cli@beta
 ```
 
-Choose a release channel when you want to validate prereleases before stable rollout:
+Use `opencore update` to run the global update through the detected package
+manager. It does not download or replace binaries itself. Select a manager or
+beta explicitly when needed:
 
 ```bash
-opencore update --channel stable
+opencore update
 opencore update --channel beta
+opencore update --package-manager pnpm
+opencore update --package-manager yarn
+```
+
+## Release process
+
+Keep every npm package at the same version. Never edit only one `package.json`
+or reuse a version already published to npm.
 
-OPENCORE_UPDATE_CHANNEL=beta opencore build
+```bash
+npm run version:set -- 2.0.0-beta.2
+npm run release:check
+git add package.json npm/*/package.json
+git commit -m "chore: prepare v2.0.0-beta.2"
+git push origin develop
 ```
 
-For npm installations, use dist-tags directly:
+After the release commit is on `develop` or `master`, verify and create the
+matching tag. GitHub Actions verifies the tag version and publishes the
+packages automatically.
 
 ```bash
-npm install -g @open-core/cli
-npm install -g @open-core/cli@beta
+npm run version:check-tag -- v2.0.0-beta.2
+git tag -a v2.0.0-beta.2 -m "OpenCore CLI 2.0.0 beta 2"
+git push origin v2.0.0-beta.2
 ```
 
 ---
diff --git a/bin/opencore.js b/bin/opencore.js
new file mode 100644
index 0000000..d71d80a
--- /dev/null
+++ b/bin/opencore.js
@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const { run } = require('../platform');
+
+process.exitCode = run(process.argv.slice(2));
diff --git a/binary.js b/binary.js
deleted file mode 100644
index c423863..0000000
--- a/binary.js
+++ /dev/null
@@ -1,62 +0,0 @@
-const path = require('path');
-const os = require('os');
-const fs = require('fs');
-
-function getPlatform() {
-  const platform = os.platform();
-  const arch = os.arch();
-  
-  if (platform === 'win32') {
-    return arch === 'x64' ? 'windows-amd64' : null;
-  }
-  
-  if (platform === 'darwin') {
-    if (arch === 'arm64') return 'darwin-arm64';
-    if (arch === 'x64') return 'darwin-amd64';
-    return null;
-  }
-  
-  if (platform === 'linux') {
-    return arch === 'x64' ? 'linux-amd64' : null;
-  }
-  
-  return null;
-}
-
-function getBinaryName() {
-  const platform = os.platform();
-  return platform === 'win32' ? 'opencore.exe' : 'opencore';
-}
-
-function getBinaryPath() {
-  const platform = getPlatform();
-  if (!platform) {
-    throw new Error(`Unsupported platform: ${os.platform()} ${os.arch()}`);
-  }
-  
-  const binaryName = getBinaryName();
-  const binaryPath = path.join(__dirname, 'bin', binaryName);
-  
-  if (!fs.existsSync(binaryPath)) {
-    throw new Error(
-      `Binary not found at ${binaryPath}. ` +
-      `This might be an installation issue. Please try reinstalling @open-core/cli.`
-    );
-  }
-
-  if (os.platform() !== 'win32') {
-    try {
-      fs.chmodSync(binaryPath, 0o755);
-    } catch (error) {
-      throw new Error(`Failed to make binary executable at ${binaryPath}: ${error.message}`);
-    }
-  }
-  
-  return binaryPath;
-}
-
-module.exports = {
-  getPlatform,
-  getBinaryName,
-  getBinaryPath
-};
diff --git a/docs/commands.md b/docs/commands.md
index 5e697de..4ac0cda 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -10,7 +10,7 @@
 | `opencore create <type>` | Create scaffolding |
 | `opencore clone <template>` | Clone official template |
 | `opencore doctor` | Validate configuration |
-| `opencore update` | Update the CLI |
+| `opencore update` | Update the CLI through npm, pnpm, or Yarn |
 | `opencore --version` | Display CLI version |
 
 ## init
@@ -119,13 +119,17 @@ Checks:
 
 ## update
 
-Update the CLI from the selected release channel.
+Update the CLI through the package manager instead of downloading a binary.
+The command detects the invoking npm, pnpm, or Yarn Classic process when
+possible and otherwise uses npm.
 
 ```bash
 opencore update
 opencore update --channel beta
+opencore update --package-manager pnpm
+opencore update --package-manager yarn
 ```
 
 Options:
-- `--channel stable|beta` selects which release stream to check
-- `OPENCORE_UPDATE_CHANNEL=beta` changes the default channel for update checks
+- `--channel stable|beta` chooses the npm dist-tag (`latest` or `beta`)
+- `-p, --package-manager auto|npm|pnpm|yarn` chooses the global package manager
diff --git a/go.mod b/go.mod
index d9bd9cf..d3b60db 100644
--- a/go.mod
+++ b/go.mod
@@ -3,19 +3,16 @@ module github.com/newcore-network/opencore-cli
 go 1.24.5
 
 require (
-	github.com/blang/semver/v4 v4.0.0
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/huh v0.8.0
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/minio/selfupdate v0.6.0
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/term v0.40.0
 )
 
 require (
-	aead.dev/minisign v0.3.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
@@ -41,7 +38,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.34.0 // indirect
 )
diff --git a/go.sum b/go.sum
index b965726..1827a75 100644
--- a/go.sum
+++ b/go.sum
@@ -1,6 +1,3 @@
-aead.dev/minisign v0.2.0/go.mod h1:zdq6LdSd9TbuSxchxwhpA9zEb9YXcVGoE8JakuiGaIQ=
-aead.dev/minisign v0.3.0 h1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=
-aead.dev/minisign v0.3.0/go.mod h1:NLvG3Uoq3skkRMDuc3YHpWUTMTrSExqm+Ij73W13F6Y=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
@@ -9,8 +6,6 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3vj1nolY=
 github.com/aymanbagabas/go-udiff v0.3.1/go.mod h1:G0fsKmG+P6ylD0r6N/KgQD/nWzgfnl8ZBcNLgcbrw8E=
-github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
-github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/catppuccin/go v0.3.0 h1:d+0/YicIq+hSTo5oPuRi5kOpqkVA5tAsU6dNhvRu+aY=
 github.com/catppuccin/go v0.3.0/go.mod h1:8IHJuMGaUUjQM82qBrGNBv7LFq6JI3NnQCF6MOlZjpc=
 github.com/charmbracelet/bubbles v1.0.0 h1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=
@@ -66,8 +61,6 @@ github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2J
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.20 h1:WcT52H91ZUAwy8+HUkdM3THM6gXqXuLJi9O3rjcQQaQ=
 github.com/mattn/go-runewidth v0.0.20/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/minio/selfupdate v0.6.0 h1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU=
-github.com/minio/selfupdate v0.6.0/go.mod h1:bO02GTIPCMQFTEvE5h4DjYB58bCoZ35XLeBf0buTDdM=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
@@ -87,32 +80,14 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20211209193657-4570a0811e8b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210228012217-479acdf4ea46/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
 golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
 golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
 golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/index.d.ts b/index.d.ts
index aa45d2e..371df58 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -826,6 +826,82 @@ export interface BuildConfig {
    * @default 'development'
    */
   environment?: string;
+
+  /**
+   * Controls generation of the per-resource `.opencore/opencore.gen.ts` files that give
+   * end-to-end type safety to net events, RPCs, commands and WebView messages.
+   *
+   * @example
+   * ```ts
+   * build: {
+   *   typegen: { enabled: true, strict: true }
+   * }
+   * ```
+   */
+  typegen?: TypegenConfig;
+
+  /**
+   * Type-check the project with its own `tsc --noEmit` (root `tsconfig.json`).
+   *
+   * Bundling only strips types, so without this a type error — including an unknown name under
+   * `typegen.strict` — never fails a build. When enabled, `opencore build` regenerates the types
+   * and runs the check before bundling, and fails on any error without writing any output;
+   * `opencore dev` reports errors as warnings and keeps watching.
+   *
+   * Requires `typescript` installed in the project.
+   *
+   * @default false
+   */
+  typecheck?: boolean;
+}
+
+/**
+ * Type generation options.
+ *
+ * @remarks
+ * The CLI scans each resource for `@Server.OnNet`, `@Client.OnNet`, `@Server.OnRPC`,
+ * `@Client.OnRPC`, `@Server.Command` and `@Client.OnView` decorators, plus the client's
+ * WebView `send()` calls, and emits a `.opencore/opencore.gen.ts` that augments the
+ * framework's `Register` interface. Every resource files its maps under its own key and the
+ * framework merges them, so names declared by one resource are known to all of them.
+ * Emitting sites — `player.emit()`, `events.emit()`, `rpc.call()`, `WebView.send()` — then
+ * autocomplete to the declared names and check their payloads against the handler signatures.
+ *
+ * A resource with a WebView directory (`ui/`, `nui/` or the configured one) also gets a
+ * `<view>/.opencore/opencore.gen.ts` exporting `UiCanSend` and `UiReceives` for the UI code.
+ *
+ * A `send()` payload is typed only when it forwards a parameter of the enclosing method;
+ * any other expression is typed `unknown` and reported as a warning.
+ *
+ * Generated files live under `.opencore/`, which the starter `.gitignore` already excludes,
+ * and are regenerated by both `opencore dev` and `opencore build`. The project `tsconfig.json`
+ * must include the `.opencore` directories (the starter's `include` already does).
+ */
+export interface TypegenConfig {
+  /**
+   * Enable type generation.
+   *
+   * When disabled, existing generated files are deleted and every signature reverts to its
+   * previous loose form — no source changes required.
+   *
+   * @default true
+   */
+  enabled?: boolean;
+
+  /**
+   * Treat unknown event, RPC and WebView message names as compile errors.
+   *
+   * These are type errors: they show in the editor and in `tsc`, and fail `opencore build`
+   * only when `build.typecheck` is enabled.
+   *
+   * Set it to `false` when the project legitimately emits names that no OpenCore handler
+   * declares, such as events handled by non-OpenCore resources: those names are then accepted
+   * while known names keep their autocomplete and payload checking. The framework's own
+   * `opencore:*` events are accepted in both modes.
+   *
+   * @default true
+   */
+  strict?: boolean;
 }
 
 /**
diff --git a/index.js b/index.js
index a89a08f..6a4e9bd 100644
--- a/index.js
+++ b/index.js
@@ -1,31 +1,4 @@
 #!/usr/bin/env node
 
-const { getBinaryPath } = require('./binary');
-const { spawn } = require('child_process');
-
-// Export config helper for opencore.config.ts
 const { defineConfig } = require('./config-helper');
 module.exports = { defineConfig };
-
-// Only run the binary if this is being executed directly
-if (require.main === module) {
-  const binaryPath = getBinaryPath();
-
-  const child = spawn(binaryPath, process.argv.slice(2), {
-    stdio: 'inherit',
-    windowsHide: true
-  });
-
-  child.on('exit', (code) => {
-    process.exit(code || 0);
-  });
-
-  process.on('SIGINT', () => {
-    child.kill('SIGINT');
-  });
-
-  process.on('SIGTERM', () => {
-    child.kill('SIGTERM');
-  });
-}
-
diff --git a/install.js b/install.js
deleted file mode 100644
index a6d9358..0000000
--- a/install.js
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/usr/bin/env node
-
-const https = require('https');
-const fs = require('fs');
-const path = require('path');
-const { getPlatform, getBinaryName } = require('./binary');
-
-const VERSION = require('./package.json').version;
-const GITHUB_REPO = 'newcore-network/opencore-cli';
-
-async function download(url, dest) {
-  return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(dest);
-    
-    https.get(url, (response) => {
-      if (response.statusCode === 302 || response.statusCode === 301) {
-        // Follow redirect
-        return download(response.headers.location, dest).then(resolve).catch(reject);
-      }
-      
-      if (response.statusCode !== 200) {
-        reject(new Error(`Failed to download: ${response.statusCode} ${response.statusMessage}`));
-        return;
-      }
-      
-      const totalBytes = parseInt(response.headers['content-length'], 10);
-      let downloadedBytes = 0;
-      
-      response.on('data', (chunk) => {
-        downloadedBytes += chunk.length;
-        const percent = ((downloadedBytes / totalBytes) * 100).toFixed(1);
-        process.stdout.write(`\rDownloading OpenCore CLI... ${percent}%`);
-      });
-      
-      response.pipe(file);
-      
-      file.on('finish', () => {
-        file.close();
-        console.log('\nDownload complete!');
-        resolve();
-      });
-    }).on('error', (err) => {
-      fs.unlink(dest, () => {});
-      reject(err);
-    });
-  });
-}
-
-async function install() {
-  try {
-    console.log('Installing OpenCore CLI...');
-    
-    const platform = getPlatform();
-    if (!platform) {
-      throw new Error(`Unsupported platform: ${process.platform} ${process.arch}`);
-    }
-    
-    const binaryName = getBinaryName();
-    const binDir = path.join(__dirname, 'bin');
-    
-    // Create bin directory
-    if (!fs.existsSync(binDir)) {
-      fs.mkdirSync(binDir, { recursive: true });
-    }
-    
-    const binaryPath = path.join(binDir, binaryName);
-
-    // Skip download if binary already exists (e.g. built locally via `go build` for development)
-    if (fs.existsSync(binaryPath)) {
-      if (process.platform !== 'win32') {
-        fs.chmodSync(binaryPath, 0o755);
-      }
-      console.log('OpenCore CLI binary already exists, skipping download.');
-      return;
-    }
-
-    // Download binary from GitHub releases
-    const downloadUrl = `https://github.com/${GITHUB_REPO}/releases/download/v${VERSION}/opencore-${platform}${platform.startsWith('windows') ? '.exe' : ''}`;
-    
-    console.log(`Downloading from: ${downloadUrl}`);
-    await download(downloadUrl, binaryPath);
-    
-    // Make binary executable on Unix systems
-    if (process.platform !== 'win32') {
-      fs.chmodSync(binaryPath, 0o755);
-    }
-    
-    console.log('✓ OpenCore CLI installed successfully!');
-    console.log(`Run 'opencore --version' to verify installation.`);
-  } catch (error) {
-    console.error('Failed to install OpenCore CLI:', error.message);
-    console.error('\nYou can manually download the binary from:');
-    console.error(`https://github.com/${GITHUB_REPO}/releases/tag/v${VERSION}`);
-    process.exit(1);
-  }
-}
-
-install();
diff --git a/internal/builder/autoload_controllers.go b/internal/builder/autoload_controllers.go
index 718f653..b3cb5e2 100644
--- a/internal/builder/autoload_controllers.go
+++ b/internal/builder/autoload_controllers.go
@@ -15,9 +15,9 @@ var (
 	serverControllerDecoratorPattern      = regexp.MustCompile(`@Server\.Controller\s*\(`)
 	clientControllerDecoratorPattern      = regexp.MustCompile(`@Client\.Controller\s*\(`)
 	controllerDecoratorPattern            = regexp.MustCompile(`@Controller\s*\(`)
-	frameworkServerImportPattern          = regexp.MustCompile(`(?:from\s+['"]@open-core/framework/server['"]|import\s+['"]@open-core/framework/server['"]|require\(\s*['"]@open-core/framework/server['"]\s*\))`)
-	frameworkClientImportPattern          = regexp.MustCompile(`(?:from\s+['"]@open-core/framework/client['"]|import\s+['"]@open-core/framework/client['"]|require\(\s*['"]@open-core/framework/client['"]\s*\))`)
-	invalidFrameworkNodeModulesImportExpr = regexp.MustCompile(`(?:from\s+['"][^'"]*node_modules[\\/]+@open-core[\\/]framework(?:[\\/][^'"]*)?['"]|import\s+['"][^'"]*node_modules[\\/]+@open-core[\\/]framework(?:[\\/][^'"]*)?['"]|require\(\s*['"][^'"]*node_modules[\\/]+@open-core[\\/]framework(?:[\\/][^'"]*)?['"]\s*\))`)
+	frameworkServerImportPattern          = regexp.MustCompile(`^\s*(?:import\s+(?:.+\s+from\s+)?['"]@open-core/framework/server['"]|(?:.+?=\s*)?require\(\s*['"]@open-core/framework/server['"]\s*\))`)
+	frameworkClientImportPattern          = regexp.MustCompile(`^\s*(?:import\s+(?:.+\s+from\s+)?['"]@open-core/framework/client['"]|(?:.+?=\s*)?require\(\s*['"]@open-core/framework/client['"]\s*\))`)
+	invalidFrameworkNodeModulesImportExpr = regexp.MustCompile(`^\s*(?:import\s+(?:.+\s+from\s+)?['"][^'"]*node_modules[\\/]+@open-core[\\/]framework(?:[\\/][^'"]*)?['"]|(?:.+?=\s*)?require\(\s*['"][^'"]*node_modules[\\/]+@open-core[\\/]framework(?:[\\/][^'"]*)?['"]\s*\))`)
 )
 
 type SourceValidationIssue struct {
@@ -67,7 +67,8 @@ func scanResourceTypeScriptFiles(resourcePath string, baseDir string, serverOutF
 		if readErr != nil {
 			return readErr
 		}
-		text := string(content)
+		text := blankComments(string(content))
+		codeText := blankStringContents(text)
 
 		relPath, relErr := filepath.Rel(resourcePath, path)
 		if relErr != nil {
@@ -76,6 +77,7 @@ func scanResourceTypeScriptFiles(resourcePath string, baseDir string, serverOutF
 		relPath = filepath.ToSlash(relPath)
 
 		lines := strings.Split(text, "\n")
+		codeLines := strings.Split(codeText, "\n")
 		clientDecoratorLine := 0
 		serverDecoratorLine := 0
 		controllerDecoratorLine := 0
@@ -83,14 +85,15 @@ func scanResourceTypeScriptFiles(resourcePath string, baseDir string, serverOutF
 		frameworkClientImportLine := 0
 
 		for idx, line := range lines {
+			codeLine := codeLines[idx]
 			lineNumber := idx + 1
-			if clientDecoratorLine == 0 && clientDecoratorPattern.MatchString(line) {
+			if clientDecoratorLine == 0 && clientDecoratorPattern.MatchString(codeLine) {
 				clientDecoratorLine = lineNumber
 			}
-			if serverDecoratorLine == 0 && serverDecoratorPattern.MatchString(line) {
+			if serverDecoratorLine == 0 && serverDecoratorPattern.MatchString(codeLine) {
 				serverDecoratorLine = lineNumber
 			}
-			if controllerDecoratorLine == 0 && controllerDecoratorPattern.MatchString(line) {
+			if controllerDecoratorLine == 0 && controllerDecoratorPattern.MatchString(codeLine) {
 				controllerDecoratorLine = lineNumber
 			}
 			if frameworkServerImportLine == 0 && frameworkServerImportPattern.MatchString(line) {
@@ -135,10 +138,10 @@ func scanResourceTypeScriptFiles(resourcePath string, baseDir string, serverOutF
 			})
 		}
 
-		hasServerController := serverControllerDecoratorPattern.MatchString(text)
-		hasClientController := clientControllerDecoratorPattern.MatchString(text)
+		hasServerController := serverControllerDecoratorPattern.MatchString(codeText)
+		hasClientController := clientControllerDecoratorPattern.MatchString(codeText)
 
-		hasGenericController := controllerDecoratorPattern.MatchString(text)
+		hasGenericController := controllerDecoratorPattern.MatchString(codeText)
 		if hasGenericController {
 			if frameworkServerImportLine > 0 && frameworkClientImportLine == 0 {
 				hasServerController = true
@@ -190,6 +193,33 @@ func scanResourceTypeScriptFiles(resourcePath string, baseDir string, serverOutF
 	return serverImports, clientImports, issues, nil
 }
 
+func blankStringContents(text string) string {
+	out := []byte(text)
+	var quote byte
+	for i := 0; i < len(out); i++ {
+		if quote == 0 {
+			if out[i] == '\'' || out[i] == '"' || out[i] == '`' {
+				quote = out[i]
+			}
+			continue
+		}
+		if out[i] == '\\' {
+			if i+1 < len(out) {
+				i++
+			}
+			continue
+		}
+		if out[i] == quote {
+			quote = 0
+			continue
+		}
+		if out[i] != '\n' && out[i] != '\r' {
+			out[i] = ' '
+		}
+	}
+	return string(out)
+}
+
 func (rb *ResourceBuilder) validateSourceFiles(resourcePath string) ([]SourceValidationIssue, error) {
 	resourcePath = filepath.Clean(resourcePath)
 	outDir := filepath.Join(resourcePath, ".opencore")
diff --git a/internal/builder/builder.go b/internal/builder/builder.go
index 19d00fa..4775333 100644
--- a/internal/builder/builder.go
+++ b/internal/builder/builder.go
@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -25,6 +26,8 @@ type Builder struct {
 	config          *config.Config
 	resourceBuilder *ResourceBuilder
 	deployer        *Deployer
+
+	typecheckWarnOnly bool
 }
 
 func normalizedBuildPath(p string) string {
@@ -147,11 +150,23 @@ func buildResourceSideValue(side *config.ResourceBuildSideConfig, base *config.B
 }
 
 func New(cfg *config.Config) *Builder {
-	return &Builder{
+	resourceBuilder := NewResourceBuilder(".")
+	resourceBuilder.ConfigureTypegen(cfg.Build.TypegenEnabled(), TypegenOptions{
+		Strict: cfg.Build.TypegenStrict(),
+	})
+
+	b := &Builder{
 		config:          cfg,
-		resourceBuilder: NewResourceBuilder("."),
+		resourceBuilder: resourceBuilder,
 		deployer:        NewDeployer(cfg),
 	}
+	resourceBuilder.SetViewPathResolver(b.ViewPathFor)
+
+	return b
+}
+
+func (b *Builder) ResourceBuilder() *ResourceBuilder {
+	return b.resourceBuilder
 }
 
 func (b *Builder) CollectTasks() []BuildTask {
@@ -204,6 +219,9 @@ func (b *Builder) BuildWithOutputContext(ctx context.Context, requestedMode Outp
 	if err := b.validateTaskSources(tasks); err != nil {
 		return err
 	}
+	if err := b.typecheck(ctx, tasks, plain); err != nil {
+		return err
+	}
 	sharedOptions, sharedName, err := b.sharedDependencyOptions(tasks)
 	if err != nil {
 		return err
@@ -234,7 +252,7 @@ func (b *Builder) BuildWithOutputContext(ctx context.Context, requestedMode Outp
 
 	// Determine number of workers
 	workers := b.config.Build.MaxWorkers
-	if workers == 0 {
+	if workers <= 0 {
 		workers = runtime.NumCPU()
 	}
 	if workers > len(tasks) {
@@ -261,7 +279,7 @@ func (b *Builder) BuildWithOutputContext(ctx context.Context, requestedMode Outp
 		return err
 	}
 
-	if err := b.writeRuntimeArtifacts(results); err != nil {
+	if err := b.writeRuntimeArtifactsWithExisting(results, false); err != nil {
 		return fmt.Errorf("failed to write runtime artifacts: %w", err)
 	}
 
@@ -309,6 +327,9 @@ func (b *Builder) BuildTasksContext(ctx context.Context, tasks []BuildTask) ([]B
 	if err := b.validateTaskSources(tasks); err != nil {
 		return nil, err
 	}
+	if err := b.typecheck(ctx, tasks, false); err != nil {
+		return nil, err
+	}
 	sharedOptions, sharedName, err := b.sharedDependencyOptions(tasks)
 	if err != nil {
 		return nil, err
@@ -342,7 +363,7 @@ func (b *Builder) BuildTasksContext(ctx context.Context, tasks []BuildTask) ([]B
 		return results, err
 	}
 
-	if err := b.writeRuntimeArtifacts(results); err != nil {
+	if err := b.writeRuntimeArtifactsWithExisting(results, true); err != nil {
 		return results, fmt.Errorf("failed to write runtime artifacts: %w", err)
 	}
 
@@ -358,12 +379,16 @@ func (b *Builder) BuildTasksContext(ctx context.Context, tasks []BuildTask) ([]B
 }
 
 func (b *Builder) writeRuntimeArtifacts(results []BuildResult) error {
+	return b.writeRuntimeArtifactsWithExisting(results, true)
+}
+
+func (b *Builder) writeRuntimeArtifactsWithExisting(results []BuildResult, preserveExisting bool) error {
 	if b.runtimeKind() != "ragemp" {
 		return nil
 	}
 
-	serverResources := b.collectBarrelResources(results, "server")
-	clientResources := b.collectBarrelResources(results, "client")
+	serverResources := b.collectBarrelResources(results, "server", preserveExisting)
+	clientResources := b.collectBarrelResources(results, "client", preserveExisting)
 
 	if err := writeRuntimeBarrel(filepath.Join(b.config.OutDir, "packages", "index.js"), serverResources); err != nil {
 		return err
@@ -375,9 +400,24 @@ func (b *Builder) writeRuntimeArtifacts(results []BuildResult) error {
 	return nil
 }
 
-func (b *Builder) collectBarrelResources(results []BuildResult, side string) []string {
+func (b *Builder) collectBarrelResources(results []BuildResult, side string, preserveExisting bool) []string {
 	seen := make(map[string]struct{})
 	resources := make([]string, 0)
+	root := filepath.Join(b.config.OutDir, "packages")
+	if side == "client" {
+		root = filepath.Join(b.config.OutDir, "client_packages")
+	}
+	if entries, err := os.ReadDir(root); preserveExisting && err == nil {
+		for _, entry := range entries {
+			if !entry.IsDir() {
+				continue
+			}
+			if _, err := os.Stat(filepath.Join(root, entry.Name(), "index.js")); err == nil {
+				seen[entry.Name()] = struct{}{}
+				resources = append(resources, entry.Name())
+			}
+		}
+	}
 
 	for _, result := range results {
 		if !result.Success || result.Task.Type == TypeViews {
@@ -444,10 +484,29 @@ func writeRuntimeBarrel(filePath string, resources []string) error {
 	return os.WriteFile(filePath, []byte(strings.Join(lines, "\n")), 0644)
 }
 
+var conventionalViewDirs = []string{"ui", "nui", "view", "views", "web", "html"}
+
+func newViewDirSkipper(viewPath string) func(path string, name string) bool {
+	normalizedView := ""
+	if viewPath != "" {
+		normalizedView = filepath.ToSlash(filepath.Clean(viewPath))
+	}
+
+	return func(path string, name string) bool {
+		switch name {
+		case "node_modules", "dist", ".opencore":
+			return true
+		}
+		if slices.Contains(conventionalViewDirs, name) {
+			return true
+		}
+		return normalizedView != "" && filepath.ToSlash(filepath.Clean(path)) == normalizedView
+	}
+}
+
 // findViewsPath searches for a views directory in a resource path
 func findViewsPath(resourcePath string) string {
-	viewDirs := []string{"ui", "view", "views", "web", "html"}
-	for _, dir := range viewDirs {
+	for _, dir := range conventionalViewDirs {
 		path := filepath.Join(resourcePath, dir)
 		if info, err := os.Stat(path); err == nil && info.IsDir() {
 			return path
@@ -456,6 +515,44 @@ func findViewsPath(resourcePath string) string {
 	return ""
 }
 
+func (b *Builder) ViewPathFor(resourcePath string) string {
+	if b == nil || b.config == nil {
+		return findViewsPath(resourcePath)
+	}
+
+	views := resolveViewsConfig(resourcePath, b.viewsDefaultsFor(resourcePath))
+	if views == nil {
+		return ""
+	}
+	return views.Path
+}
+
+func (b *Builder) viewsDefaultsFor(resourcePath string) *config.ViewsConfig {
+	if views := b.config.GetResourceViews(resourcePath); views != nil {
+		return views
+	}
+	if b.config.Standalones != nil && matchesAnyInclude(b.config.Standalones.Include, resourcePath) {
+		return b.config.Standalones.Views
+	}
+	return b.config.Resources.Views
+}
+
+func matchesAnyInclude(patterns []string, resourcePath string) bool {
+	target := filepath.Clean(resourcePath)
+	for _, pattern := range patterns {
+		matches, err := filepath.Glob(pattern)
+		if err != nil {
+			continue
+		}
+		for _, match := range matches {
+			if filepath.Clean(match) == target {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func detectViewFramework(viewPath string) string {
 	if hasViteConfig(viewPath) {
 		return "vite"
@@ -854,23 +951,23 @@ func (b *Builder) collectAllTasks() []BuildTask {
 
 	tasks = append(tasks, coreTask)
 
-	// Core views if configured
-	if b.config.Core.Views != nil {
+	// Core views if configured or discovered.
+	if viewsConfig := resolveViewsConfig(b.config.Core.Path, b.config.Core.Views); viewsConfig != nil {
 		tasks = append(tasks, BuildTask{
-			Path:           b.config.Core.Views.Path,
+			Path:           viewsConfig.Path,
 			ResourceName:   b.config.Core.ResourceName + "/ui",
 			Type:           TypeViews,
 			OutDir:         coreLayout.ViewsOutDir,
 			CustomCompiler: b.config.Core.CustomCompiler, // Use core's custom compiler for views too
 			Options: BuildOptions{
-				Framework:    b.config.Core.Views.Framework,
-				Minify:       b.config.Build.Minify,
-				SourceMaps:   b.config.Build.SourceMaps,
-				ViewEntry:    b.config.Core.Views.EntryPoint,
-				Ignore:       b.config.Core.Views.Ignore,
-				ForceInclude: b.config.Core.Views.ForceInclude,
-				BuildCommand: b.config.Core.Views.BuildCommand,
-				OutputDir:    b.config.Core.Views.OutputDir,
+				Framework:    viewsConfig.Framework,
+				Minify:       coreTask.Options.Minify,
+				SourceMaps:   coreTask.Options.SourceMaps,
+				ViewEntry:    viewsConfig.EntryPoint,
+				Ignore:       viewsConfig.Ignore,
+				ForceInclude: viewsConfig.ForceInclude,
+				BuildCommand: viewsConfig.BuildCommand,
+				OutputDir:    viewsConfig.OutputDir,
 			},
 		})
 	}
@@ -951,6 +1048,12 @@ func (b *Builder) collectAllTasks() []BuildTask {
 						Client: explicit.EntryPoints.Client,
 					}
 				}
+				if explicit.Compile != nil {
+					task.Options.Compile = *explicit.Compile
+					if !*explicit.Compile {
+						task.Type = TypeCopy
+					}
+				}
 				if explicit.Build != nil {
 					if explicit.Build.Server != nil {
 						task.Options.Server = buildResourceSideValue(explicit.Build.Server, b.config.Build.Server)
@@ -993,8 +1096,8 @@ func (b *Builder) collectAllTasks() []BuildTask {
 						Options: BuildOptions{
 							Runtime:      layout.Runtime,
 							Framework:    framework,
-							Minify:       b.config.Build.Minify,
-							SourceMaps:   b.config.Build.SourceMaps,
+							Minify:       task.Options.Minify,
+							SourceMaps:   task.Options.SourceMaps,
 							ViewEntry:    viewsConfig.EntryPoint,
 							Ignore:       viewsConfig.Ignore,
 							ForceInclude: viewsConfig.ForceInclude,
@@ -1014,8 +1117,9 @@ func (b *Builder) collectAllTasks() []BuildTask {
 					Options: BuildOptions{
 						Runtime:      layout.Runtime,
 						Framework:    viewsConfig.Framework,
-						Minify:       b.config.Build.Minify,
-						SourceMaps:   b.config.Build.SourceMaps,
+						Minify:       task.Options.Minify,
+						SourceMaps:   task.Options.SourceMaps,
+						Ignore:       viewsConfig.Ignore,
 						ForceInclude: viewsConfig.ForceInclude,
 						BuildCommand: viewsConfig.BuildCommand,
 						OutputDir:    viewsConfig.OutputDir,
@@ -1073,6 +1177,12 @@ func (b *Builder) collectAllTasks() []BuildTask {
 				Compile:    true,
 			}),
 		}
+		if res.Compile != nil {
+			task.Options.Compile = *res.Compile
+			if !*res.Compile {
+				task.Type = TypeCopy
+			}
+		}
 
 		// Apply entryPoints if configured
 		if res.EntryPoints != nil {
@@ -1092,6 +1202,12 @@ func (b *Builder) collectAllTasks() []BuildTask {
 			if res.Build.NUI != nil {
 				task.Options.NUI = *res.Build.NUI
 			}
+			if res.Build.Minify != nil {
+				task.Options.Minify = *res.Build.Minify
+			}
+			if res.Build.SourceMaps != nil {
+				task.Options.SourceMaps = *res.Build.SourceMaps
+			}
 			if res.Build.ServerBinaries != nil {
 				task.Options.ServerBinaries = res.Build.ServerBinaries
 			}
@@ -1103,7 +1219,7 @@ func (b *Builder) collectAllTasks() []BuildTask {
 			b.applyDependencyResolution(&task.Options, &b.config.Build, nil)
 		}
 
-		// Resources are always compiled, so we can always check for views
+		// Resolve explicitly configured or conventional views independently of compilation.
 		var resourceViewsDefaults *config.ViewsConfig
 		if b.config.Resources.Views != nil {
 			resourceViewsDefaults = b.config.Resources.Views
@@ -1131,8 +1247,8 @@ func (b *Builder) collectAllTasks() []BuildTask {
 				Options: BuildOptions{
 					Runtime:      layout.Runtime,
 					Framework:    framework,
-					Minify:       b.config.Build.Minify,
-					SourceMaps:   b.config.Build.SourceMaps,
+					Minify:       task.Options.Minify,
+					SourceMaps:   task.Options.SourceMaps,
 					ViewEntry:    viewsConfig.EntryPoint,
 					Ignore:       viewsConfig.Ignore,
 					ForceInclude: viewsConfig.ForceInclude,
@@ -1164,6 +1280,10 @@ func (b *Builder) collectAllTasks() []BuildTask {
 				customCompiler := ""
 				var entryPoints *EntryPoints
 				if explicit != nil {
+					if explicit.ResourceName != "" {
+						resourceName = explicit.ResourceName
+						layout = b.resourceLayout(resourceName)
+					}
 					customCompiler = explicit.CustomCompiler
 					if explicit.EntryPoints != nil {
 						entryPoints = &EntryPoints{
@@ -1203,12 +1323,46 @@ func (b *Builder) collectAllTasks() []BuildTask {
 						EntryPoints: entryPoints,
 					}),
 				}
+				if explicit != nil && explicit.Compile != nil {
+					task.Options.Compile = *explicit.Compile
+					if !*explicit.Compile {
+						task.Type = TypeCopy
+					}
+				}
 				if explicit != nil && explicit.Build != nil {
+					applyResourceBuildOptions(&task.Options, explicit.Build, b.config.Build.Server, b.config.Build.Client)
 					b.applyDependencyResolution(&task.Options, &b.config.Build, explicit.Build)
 				} else {
 					b.applyDependencyResolution(&task.Options, &b.config.Build, nil)
 				}
 				tasks = append(tasks, task)
+
+				var explicitViews *config.ViewsConfig
+				if explicit != nil {
+					explicitViews = explicit.Views
+				}
+				viewsConfig := resolveViewsConfig(match, mergeViewsConfig(b.config.Standalones.Views, explicitViews))
+				if viewsConfig != nil {
+					tasks = append(tasks, BuildTask{
+						Path:           viewsConfig.Path,
+						ResourceName:   resourceName + "/ui",
+						Type:           TypeViews,
+						OutDir:         layout.ViewsOutDir,
+						CustomCompiler: customCompiler,
+						Options: BuildOptions{
+							Runtime:      layout.Runtime,
+							Framework:    viewsConfig.Framework,
+							Minify:       task.Options.Minify,
+							SourceMaps:   task.Options.SourceMaps,
+							ViewEntry:    viewsConfig.EntryPoint,
+							Ignore:       viewsConfig.Ignore,
+							ForceInclude: viewsConfig.ForceInclude,
+							BuildCommand: viewsConfig.BuildCommand,
+							OutputDir:    viewsConfig.OutputDir,
+							LogLevel:     standaloneLogLevel,
+						},
+					})
+				}
 			}
 		}
 
@@ -1264,6 +1418,7 @@ func (b *Builder) collectAllTasks() []BuildTask {
 			}
 
 			if res.Build != nil {
+				applyResourceBuildOptions(&task.Options, res.Build, b.config.Build.Server, b.config.Build.Client)
 				if res.Build.ServerBinaries != nil {
 					task.Options.ServerBinaries = res.Build.ServerBinaries
 				}
@@ -1278,23 +1433,24 @@ func (b *Builder) collectAllTasks() []BuildTask {
 			tasks = append(tasks, task)
 
 			// Add views task if configured
-			if res.Views != nil {
+			viewsConfig := resolveViewsConfig(res.Path, mergeViewsConfig(b.config.Standalones.Views, res.Views))
+			if viewsConfig != nil {
 				tasks = append(tasks, BuildTask{
-					Path:           res.Views.Path,
+					Path:           viewsConfig.Path,
 					ResourceName:   resourceName + "/ui",
 					Type:           TypeViews,
 					OutDir:         layout.ViewsOutDir,
 					CustomCompiler: res.CustomCompiler,
 					Options: BuildOptions{
 						Runtime:      layout.Runtime,
-						Framework:    res.Views.Framework,
-						Minify:       b.config.Build.Minify,
-						SourceMaps:   b.config.Build.SourceMaps,
-						ViewEntry:    res.Views.EntryPoint,
-						Ignore:       res.Views.Ignore,
-						ForceInclude: res.Views.ForceInclude,
-						BuildCommand: res.Views.BuildCommand,
-						OutputDir:    res.Views.OutputDir,
+						Framework:    viewsConfig.Framework,
+						Minify:       task.Options.Minify,
+						SourceMaps:   task.Options.SourceMaps,
+						ViewEntry:    viewsConfig.EntryPoint,
+						Ignore:       viewsConfig.Ignore,
+						ForceInclude: viewsConfig.ForceInclude,
+						BuildCommand: viewsConfig.BuildCommand,
+						OutputDir:    viewsConfig.OutputDir,
 					},
 				})
 			}
@@ -1309,7 +1465,35 @@ func (b *Builder) collectAllTasks() []BuildTask {
 			tasks[i].Options.EnvironmentAliases = envAliases
 		}
 	}
-	return tasks
+	seenTasks := make(map[string]struct{}, len(tasks))
+	deduplicated := tasks[:0]
+	for _, task := range tasks {
+		key := string(task.Type) + "\x00" + normalizedBuildPath(task.Path)
+		if _, found := seenTasks[key]; found {
+			continue
+		}
+		seenTasks[key] = struct{}{}
+		deduplicated = append(deduplicated, task)
+	}
+	return deduplicated
+}
+
+func applyResourceBuildOptions(opts *BuildOptions, cfg *config.ResourceBuildConfig, serverBase, clientBase *config.BuildSideConfig) {
+	if cfg.Server != nil {
+		opts.Server = buildResourceSideValue(cfg.Server, serverBase)
+	}
+	if cfg.Client != nil {
+		opts.Client = buildResourceSideValue(cfg.Client, clientBase)
+	}
+	if cfg.NUI != nil {
+		opts.NUI = *cfg.NUI
+	}
+	if cfg.Minify != nil {
+		opts.Minify = *cfg.Minify
+	}
+	if cfg.SourceMaps != nil {
+		opts.SourceMaps = *cfg.SourceMaps
+	}
 }
 
 // applyEnvironmentOverrides merges the active environment's build overrides
@@ -1606,6 +1790,9 @@ func (b *Builder) cleanResourceOutputForTasks(resourceName string, tasks []Build
 
 	for _, task := range tasks {
 		if viewsDir := strings.TrimSpace(task.OutDir); viewsDir != "" {
+			if err := validateRemovalPath(b.config.OutDir, viewsDir); err != nil {
+				return err
+			}
 			if err := os.RemoveAll(viewsDir); err != nil {
 				return err
 			}
@@ -1623,6 +1810,9 @@ func (b *Builder) cleanResourceOutputDir(resourceName string) error {
 	}
 
 	for _, resourceDir := range paths {
+		if err := validateRemovalPath(b.config.OutDir, resourceDir); err != nil {
+			return err
+		}
 		if _, err := os.Stat(resourceDir); os.IsNotExist(err) {
 			continue
 		}
@@ -1634,6 +1824,49 @@ func (b *Builder) cleanResourceOutputDir(resourceName string) error {
 	return nil
 }
 
+func validateRemovalPath(outputRoot, target string) error {
+	rootAbs, err := filepath.Abs(filepath.Clean(outputRoot))
+	if err != nil {
+		return fmt.Errorf("resolve output directory: %w", err)
+	}
+	targetAbs, err := filepath.Abs(filepath.Clean(target))
+	if err != nil {
+		return fmt.Errorf("resolve cleanup path: %w", err)
+	}
+	rel, err := filepath.Rel(rootAbs, targetAbs)
+	if err != nil || rel == "." || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return fmt.Errorf("refusing to clean %q outside output directory %q", target, outputRoot)
+	}
+
+	rootReal, err := filepath.EvalSymlinks(rootAbs)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("resolve output directory symlinks: %w", err)
+	}
+	if err != nil {
+		return nil
+	}
+	ancestor := targetAbs
+	for {
+		targetReal, evalErr := filepath.EvalSymlinks(ancestor)
+		if evalErr == nil {
+			realRel, relErr := filepath.Rel(rootReal, targetReal)
+			if relErr != nil || realRel == ".." || strings.HasPrefix(realRel, ".."+string(filepath.Separator)) {
+				return fmt.Errorf("refusing to clean %q through a path outside output directory %q", target, outputRoot)
+			}
+			break
+		}
+		if !os.IsNotExist(evalErr) {
+			return fmt.Errorf("resolve cleanup path symlinks: %w", evalErr)
+		}
+		parent := filepath.Dir(ancestor)
+		if parent == ancestor {
+			break
+		}
+		ancestor = parent
+	}
+	return nil
+}
+
 func cleanResourceDir(resourceDir string) error {
 	markerPath := filepath.Join(resourceDir, ".opencore-deps.json")
 	if _, err := os.Stat(markerPath); err != nil {
diff --git a/internal/builder/builder_test.go b/internal/builder/builder_test.go
index 78b5118..0ddda01 100644
--- a/internal/builder/builder_test.go
+++ b/internal/builder/builder_test.go
@@ -1082,6 +1082,102 @@ func TestWriteRuntimeArtifactsRageMPBarrels(t *testing.T) {
 	}
 }
 
+func TestWriteRuntimeArtifactsPreservesResourcesOnPartialBuild(t *testing.T) {
+	outDir := t.TempDir()
+	cfg := &config.Config{
+		OutDir: outDir,
+		Core:   config.CoreConfig{ResourceName: "core"},
+		Adapter: &config.AdapterConfig{
+			Server: &config.AdapterBinding{Name: "ragemp", Valid: true},
+			Client: &config.AdapterBinding{Name: "ragemp", Valid: true},
+		},
+	}
+	b := New(cfg)
+	for _, side := range []string{"packages", "client_packages"} {
+		for _, name := range []string{"existing", "rebuilt"} {
+			writeTestFile(t, outDir, filepath.Join(side, name, "index.js"), "module.exports = {}\n")
+		}
+	}
+
+	results := []BuildResult{{Success: true, Task: BuildTask{
+		ResourceName: "rebuilt",
+		Type:         TypeResource,
+		Options: BuildOptions{
+			Server: SideConfigValue{Enabled: true},
+			Client: SideConfigValue{Enabled: true},
+		},
+	}}}
+	if err := b.writeRuntimeArtifacts(results); err != nil {
+		t.Fatal(err)
+	}
+	for _, side := range []string{"packages", "client_packages"} {
+		content, err := os.ReadFile(filepath.Join(outDir, side, "index.js"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !strings.Contains(string(content), "require('./existing')") {
+			t.Fatalf("partial %s barrel lost existing resource:\n%s", side, content)
+		}
+	}
+}
+
+func TestValidateRemovalPathRejectsEscapes(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	if err := validateRemovalPath(root, outside); err == nil {
+		t.Fatal("expected outside path to be rejected")
+	}
+	if err := validateRemovalPath(root, root); err == nil {
+		t.Fatal("expected output root itself to be rejected")
+	}
+	if err := validateRemovalPath(root, filepath.Join(root, "resource")); err != nil {
+		t.Fatalf("expected child path to be accepted: %v", err)
+	}
+
+	link := filepath.Join(root, "escape")
+	if err := os.Symlink(outside, link); err == nil {
+		if err := validateRemovalPath(root, filepath.Join(link, "resource")); err == nil {
+			t.Fatal("expected symlink escape to be rejected")
+		}
+	}
+}
+
+func TestCollectAllTasksCompileFalseAndOverrides(t *testing.T) {
+	falseValue := false
+	trueValue := true
+	cfg := &config.Config{
+		OutDir: "dist",
+		Core:   config.CoreConfig{Path: "core", ResourceName: "core"},
+		Build:  config.BuildConfig{Minify: true},
+		Resources: config.ResourcesConfig{Explicit: []config.ExplicitResource{{
+			Path: "resources/raw", Compile: &falseValue,
+			Build: &config.ResourceBuildConfig{Minify: &falseValue, SourceMaps: &trueValue},
+		}}},
+		Standalones: &config.StandaloneConfig{Explicit: []config.ExplicitResource{{
+			Path: "standalones/raw", Compile: &falseValue,
+			Build: &config.ResourceBuildConfig{Minify: &falseValue, SourceMaps: &trueValue},
+		}}},
+	}
+	tasks := New(cfg).collectAllTasks()
+	for _, path := range []string{"resources/raw", "standalones/raw"} {
+		var found *BuildTask
+		for i := range tasks {
+			if normalizedBuildPath(tasks[i].Path) == path {
+				found = &tasks[i]
+			}
+		}
+		if found == nil {
+			t.Fatalf("missing task %s", path)
+		}
+		if found.Type != TypeCopy || found.Options.Compile {
+			t.Fatalf("%s did not honor compile:false: %#v", path, found)
+		}
+		if found.Options.Minify || !found.Options.SourceMaps {
+			t.Fatalf("%s did not honor build overrides: %#v", path, found.Options)
+		}
+	}
+}
+
 func TestHasClientCode(t *testing.T) {
 	tmpDir := t.TempDir()
 
diff --git a/internal/builder/embedded/build_functions.js b/internal/builder/embedded/build_functions.js
index c1624d9..ed45bbd 100644
--- a/internal/builder/embedded/build_functions.js
+++ b/internal/builder/embedded/build_functions.js
@@ -172,6 +172,13 @@ async function checkNativePackages(resourcePath, options = {}) {
 
     const { warnings, errors } = await detectNativePackages(nodeModulesPath, allExternals)
     printNativePackageWarnings(warnings, errors)
+    if (errors.length > 0 && options.runtime !== 'ragemp') {
+        throw new Error(`[build] ${errors.length} incompatible native external package(s) detected: ${errors.map(error => error.package).join(', ')}`)
+    }
+}
+
+function nodeEnvDefine(buildOptions) {
+    return { 'process.env.NODE_ENV': buildOptions.minifyWhitespace ? '"production"' : '"development"' }
 }
 
 /**
@@ -239,6 +246,7 @@ async function buildCore(resourcePath, outDir, options = {}) {
             plugins: getCorePlugins(true, serverExternals, serverTarget, serverFormat, resourcePath, options.packageManager, options.dependencyResolution, usedServerExternals, options.environmentAliases),
             external: esbuildExternals(serverExternals, options.dependencyResolution),
             define: {
+				...nodeEnvDefine(serverBuildOptions),
                 '__OPENCORE_LOG_LEVEL__': JSON.stringify(options.logLevel || 'INFO'),
                 '__OPENCORE_TARGET__': '"server"',
                 '__OPENCORE_RESOURCE_NAME__': JSON.stringify(options.resourceName || '')
@@ -260,6 +268,7 @@ async function buildCore(resourcePath, outDir, options = {}) {
             plugins: getCorePlugins(false, clientExternals, clientTarget, clientFormat, resourcePath, options.packageManager, options.dependencyResolution, null, options.environmentAliases),
             external: clientExternals,
             define: {
+				...nodeEnvDefine(clientBuildOptions),
                 '__OPENCORE_LOG_LEVEL__': JSON.stringify(options.logLevel || 'INFO'),
                 '__OPENCORE_TARGET__': '"client"',
                 '__OPENCORE_RESOURCE_NAME__': JSON.stringify(options.resourceName || '')
@@ -312,6 +321,7 @@ async function buildResource(resourcePath, outDir, options = {}) {
             external: esbuildExternals(serverExternals, options.dependencyResolution),
             define: {
                 ...shared.define,
+				...nodeEnvDefine(serverBuildOptions),
                 '__OPENCORE_LOG_LEVEL__': JSON.stringify(options.logLevel || 'INFO'),
                 '__OPENCORE_TARGET__': '"server"',
                 '__OPENCORE_RESOURCE_NAME__': JSON.stringify(options.resourceName || '')
@@ -334,6 +344,7 @@ async function buildResource(resourcePath, outDir, options = {}) {
             external: clientExternals,
             define: {
                 ...shared.define,
+				...nodeEnvDefine(clientBuildOptions),
                 '__OPENCORE_LOG_LEVEL__': JSON.stringify(options.logLevel || 'INFO'),
                 '__OPENCORE_TARGET__': '"client"',
                 '__OPENCORE_RESOURCE_NAME__': JSON.stringify(options.resourceName || '')
@@ -385,6 +396,7 @@ async function buildStandalone(resourcePath, outDir, options = {}) {
             external: esbuildExternals(serverExternals, options.dependencyResolution),
             define: {
                 ...shared.define,
+				...nodeEnvDefine(serverBuildOptions),
                 '__OPENCORE_LOG_LEVEL__': JSON.stringify(options.logLevel || 'INFO'),
                 '__OPENCORE_TARGET__': '"server"',
                 '__OPENCORE_RESOURCE_NAME__': JSON.stringify(options.resourceName || '')
@@ -407,6 +419,7 @@ async function buildStandalone(resourcePath, outDir, options = {}) {
             external: clientExternals,
             define: {
                 ...shared.define,
+				...nodeEnvDefine(clientBuildOptions),
                 '__OPENCORE_LOG_LEVEL__': JSON.stringify(options.logLevel || 'INFO'),
                 '__OPENCORE_TARGET__': '"client"',
                 '__OPENCORE_RESOURCE_NAME__': JSON.stringify(options.resourceName || '')
@@ -442,6 +455,9 @@ async function copyResource(resourcePath, outDir, options = {}) {
         }
         return
     }
+	if (absOutDir.startsWith(absSrcPath + path.sep)) {
+		throw new Error(`Output path cannot be inside copied source: ${absOutDir}`)
+	}
 
     if (!fs.existsSync(absSrcPath)) {
         throw new Error(`Source path does not exist: ${absSrcPath}`)
@@ -449,19 +465,20 @@ async function copyResource(resourcePath, outDir, options = {}) {
 
     await fs.promises.mkdir(absOutDir, { recursive: true })
 
-    const entries = await fs.promises.readdir(absSrcPath, { withFileTypes: true })
+	const ignorePatterns = await readCopyIgnore(absSrcPath)
+	const entries = await fs.promises.readdir(absSrcPath, { withFileTypes: true })
     
     for (const entry of entries) {
         const src = path.join(absSrcPath, entry.name)
         const dst = path.join(absOutDir, entry.name)
         
-        if (entry.isDirectory()) {
-            if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.git' || entry.name === '.ocignore') {
-                continue
-            }
-            await copyDirRecursive(src, dst)
+		if (shouldSkipCopyEntry(entry, entry.name, ignorePatterns)) {
+			continue
+		}
+
+		if (entry.isDirectory()) {
+			await copyDirRecursive(src, dst, absSrcPath, ignorePatterns)
         } else {
-            if (entry.name === 'package.json') continue 
             await fs.promises.copyFile(src, dst)
         }
     }
@@ -476,22 +493,53 @@ async function copyResource(resourcePath, outDir, options = {}) {
 }
 
 
-async function copyDirRecursive(src, dst) {
+async function copyDirRecursive(src, dst, root, ignorePatterns) {
     await fs.promises.mkdir(dst, { recursive: true })
     const entries = await fs.promises.readdir(src, { withFileTypes: true })
     
     for (const entry of entries) {
-        const srcPath = path.join(src, entry.name)
-        const dstPath = path.join(dst, entry.name)
-        
-        if (entry.isDirectory()) {
-            await copyDirRecursive(srcPath, dstPath)
+		const srcPath = path.join(src, entry.name)
+		const dstPath = path.join(dst, entry.name)
+		const relativePath = path.relative(root, srcPath).split(path.sep).join('/')
+		
+		if (shouldSkipCopyEntry(entry, relativePath, ignorePatterns)) {
+			continue
+		}
+		if (entry.isDirectory()) {
+			await copyDirRecursive(srcPath, dstPath, root, ignorePatterns)
         } else {
             await fs.promises.copyFile(srcPath, dstPath)
         }
     }
 }
 
+async function readCopyIgnore(root) {
+	try {
+		return (await fs.promises.readFile(path.join(root, '.ocignore'), 'utf8'))
+			.split(/\r?\n/).map(line => line.trim()).filter(line => line && !line.startsWith('#'))
+	} catch (error) {
+		if (error.code !== 'ENOENT') throw error
+		return []
+	}
+}
+
+function matchesCopyPattern(relativePath, pattern) {
+	const normalized = String(pattern).replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/$/, '')
+	if (!normalized) return false
+	const literalPrefix = normalized.split('*', 1)[0].replace(/\/$/, '')
+	if (literalPrefix === relativePath) return true
+	const escaped = normalized.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*')
+	const expression = escaped.replace(/\u0000/g, '.*')
+	return new RegExp(`^(?:.*/)?${expression}(?:/.*)?$`).test(relativePath)
+}
+
+function shouldSkipCopyEntry(entry, relativePath, ignorePatterns = []) {
+	if (entry.isSymbolicLink()) return true
+	if (entry.isDirectory() && ['node_modules', 'dist', '.git', '.ocignore'].includes(entry.name)) return true
+	if (entry.name === 'package.json' || entry.name === '.ocignore') return true
+	return ignorePatterns.some(pattern => matchesCopyPattern(relativePath, pattern))
+}
+
 module.exports = {
     buildCore,
     buildResource,
diff --git a/internal/builder/embedded/config.js b/internal/builder/embedded/config.js
index 1b5f25c..ba19308 100644
--- a/internal/builder/embedded/config.js
+++ b/internal/builder/embedded/config.js
@@ -80,6 +80,11 @@ function getBuildOptions(side, options = {}) {
             'dynamic-import': true,
             'class-static-blocks': false,
         },
+        sourcemap: merged.sourceMaps ? 'inline' : false,
+        minifyWhitespace: merged.minify === true,
+        minifySyntax: merged.minify === true,
+        minifyIdentifiers: false,
+        keepNames: true,
     }
 
     // FiveM Enhanced (Node 26) breaks its global msgpack codec when a large CJS
diff --git a/internal/builder/embedded/views.js b/internal/builder/embedded/views.js
index a39e0ac..5f85a55 100644
--- a/internal/builder/embedded/views.js
+++ b/internal/builder/embedded/views.js
@@ -859,16 +859,17 @@ function readOcIgnore(viewPath) {
 }
 
 function shouldIgnore(filePath, ignorePatterns) {
-    const fileName = path.basename(filePath)
-    for (const pattern of ignorePatterns) {
-        if (pattern === fileName) return true
-        if (pattern.startsWith('*.')) {
-            const ext = pattern.slice(1)
-            if (fileName.endsWith(ext)) return true
-        }
-        if (filePath.includes(pattern)) return true
-    }
-    return false
+	const normalized = filePath.split(path.sep).join('/')
+	const fileName = path.posix.basename(normalized)
+	for (const pattern of ignorePatterns) {
+		const normalizedPattern = String(pattern).trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/$/, '')
+		if (!normalizedPattern) continue
+		if (normalizedPattern === fileName || normalized === normalizedPattern || normalized.startsWith(`${normalizedPattern}/`)) return true
+		const escaped = normalizedPattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*')
+		const expression = escaped.replace(/\u0000/g, '.*')
+		if (new RegExp(`^(?:.*/)?${expression}(?:/.*)?$`).test(normalized)) return true
+	}
+	return false
 }
 
 function isForceIncluded(filePath, forceInclude) {
@@ -1105,7 +1106,7 @@ async function buildViews(viewPath, outDir, options = {}) {
     })
 
     // Copy static assets (CSS, images, fonts, etc.) that aren't imported in JS
-    const ignorePatterns = readOcIgnore(viewPath)
+	const ignorePatterns = [...readOcIgnore(viewPath), ...(options.ignore || [])]
     await copyStaticAssets(viewPath, outDir, ignorePatterns, options.forceInclude || [])
 
     const htmlSrc = path.join(viewPath, 'index.html')
diff --git a/internal/builder/parallel.go b/internal/builder/parallel.go
index 7463dd9..14d8aec 100644
--- a/internal/builder/parallel.go
+++ b/internal/builder/parallel.go
@@ -14,18 +14,29 @@ type WorkerPool struct {
 	ctx        context.Context
 	cancel     context.CancelFunc
 	buildFunc  func(context.Context, BuildTask) BuildResult
+	closeOnce  sync.Once
+	resultMu   sync.Mutex
+	resultCond *sync.Cond
+	pending    []BuildResult
+	finished   bool
 }
 
 // NewWorkerPool creates a new worker pool with the specified number of workers
 func NewWorkerPool(workers int) *WorkerPool {
+	if workers <= 0 {
+		workers = 1
+	}
 	ctx, cancel := context.WithCancel(context.Background())
-	return &WorkerPool{
+	pool := &WorkerPool{
 		workers:    workers,
 		taskChan:   make(chan BuildTask, 100),
-		resultChan: make(chan BuildResult, 100),
+		resultChan: make(chan BuildResult),
 		ctx:        ctx,
 		cancel:     cancel,
 	}
+	pool.resultCond = sync.NewCond(&pool.resultMu)
+	go pool.dispatchResults()
+	return pool
 }
 
 // Start begins the worker pool with the given build function.
@@ -56,11 +67,37 @@ func (wp *WorkerPool) worker(id int) {
 				return
 			}
 			result := wp.buildFunc(wp.ctx, task)
-			select {
-			case wp.resultChan <- result:
-			case <-wp.ctx.Done():
-				return
-			}
+			wp.enqueueResult(result)
+		case <-wp.ctx.Done():
+			return
+		}
+	}
+}
+
+func (wp *WorkerPool) enqueueResult(result BuildResult) {
+	wp.resultMu.Lock()
+	wp.pending = append(wp.pending, result)
+	wp.resultCond.Signal()
+	wp.resultMu.Unlock()
+}
+
+func (wp *WorkerPool) dispatchResults() {
+	defer close(wp.resultChan)
+	for {
+		wp.resultMu.Lock()
+		for len(wp.pending) == 0 && !wp.finished {
+			wp.resultCond.Wait()
+		}
+		if len(wp.pending) == 0 && wp.finished {
+			wp.resultMu.Unlock()
+			return
+		}
+		result := wp.pending[0]
+		wp.pending[0] = BuildResult{}
+		wp.pending = wp.pending[1:]
+		wp.resultMu.Unlock()
+		select {
+		case wp.resultChan <- result:
 		case <-wp.ctx.Done():
 			return
 		}
@@ -90,9 +127,14 @@ func (wp *WorkerPool) Results() <-chan BuildResult {
 // Close shuts down the worker pool gracefully
 // Call this after all tasks have been submitted
 func (wp *WorkerPool) Close() {
-	close(wp.taskChan)
-	wp.wg.Wait()
-	close(wp.resultChan)
+	wp.closeOnce.Do(func() {
+		close(wp.taskChan)
+		wp.wg.Wait()
+		wp.resultMu.Lock()
+		wp.finished = true
+		wp.resultCond.Broadcast()
+		wp.resultMu.Unlock()
+	})
 }
 
 // Cancel cancels all workers immediately
diff --git a/internal/builder/parallel_test.go b/internal/builder/parallel_test.go
index 17ad628..f5ca4ad 100644
--- a/internal/builder/parallel_test.go
+++ b/internal/builder/parallel_test.go
@@ -35,6 +35,36 @@ func TestNewWorkerPool(t *testing.T) {
 	}
 }
 
+func TestNewWorkerPoolNormalizesNonPositiveWorkers(t *testing.T) {
+	for _, workers := range []int{0, -4} {
+		pool := NewWorkerPool(workers)
+		if pool.workers != 1 {
+			t.Fatalf("NewWorkerPool(%d) workers = %d, want 1", workers, pool.workers)
+		}
+		pool.Close()
+	}
+}
+
+func TestWorkerPoolDoesNotDeadlockWhenResultsExceedBuffer(t *testing.T) {
+	pool := NewWorkerPool(2)
+	pool.Start(func(task BuildTask) BuildResult { return BuildResult{Task: task, Success: true} })
+
+	tasks := make([]BuildTask, 250)
+	pool.SubmitAll(tasks)
+	done := make(chan struct{})
+	go func() {
+		pool.Close()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Close blocked on unconsumed results")
+	}
+	pool.Cancel()
+}
+
 func TestWorkerPoolBasicExecution(t *testing.T) {
 	pool := NewWorkerPool(2)
 
diff --git a/internal/builder/resource_builder.go b/internal/builder/resource_builder.go
index b520747..d1802ac 100644
--- a/internal/builder/resource_builder.go
+++ b/internal/builder/resource_builder.go
@@ -21,6 +21,28 @@ type ResourceBuilder struct {
 	embeddedScriptPath  string
 	embeddedScriptMutex sync.Mutex
 	embeddedScriptReady bool
+
+	typegenEnabled     bool
+	typegenOptions     TypegenOptions
+	typegenWarned      map[string]bool
+	typegenWarnedMutex sync.Mutex
+	viewPathResolver   func(resourcePath string) string
+}
+
+func (rb *ResourceBuilder) ConfigureTypegen(enabled bool, opts TypegenOptions) {
+	rb.typegenEnabled = enabled
+	rb.typegenOptions = opts
+}
+
+func (rb *ResourceBuilder) SetViewPathResolver(resolve func(resourcePath string) string) {
+	rb.viewPathResolver = resolve
+}
+
+func (rb *ResourceBuilder) viewPathFor(resourcePath string) string {
+	if rb.viewPathResolver != nil {
+		return rb.viewPathResolver(resourcePath)
+	}
+	return findViewsPath(resourcePath)
 }
 
 type SharedDependencyResource struct {
@@ -40,7 +62,8 @@ type SharedDependencyOptions struct {
 // NewResourceBuilder creates a new resource builder
 func NewResourceBuilder(projectPath string) *ResourceBuilder {
 	return &ResourceBuilder{
-		projectPath: projectPath,
+		projectPath:   projectPath,
+		typegenWarned: make(map[string]bool),
 	}
 }
 
@@ -56,7 +79,7 @@ func (rb *ResourceBuilder) ensureEmbeddedScript() (string, error) {
 		}
 	}
 
-	cacheDir := filepath.Join(rb.projectPath, "node_modules", ".cache", "opencore")
+	cacheDir := filepath.Join(rb.projectPath, "node_modules", ".cache", "opencore", "scripts")
 	if err := os.MkdirAll(cacheDir, 0755); err != nil {
 		return "", fmt.Errorf("failed to create cache directory: %w", err)
 	}
@@ -91,8 +114,8 @@ func (rb *ResourceBuilder) Cleanup() {
 	defer rb.embeddedScriptMutex.Unlock()
 
 	if rb.embeddedScriptPath != "" {
-		cacheDir := filepath.Dir(rb.embeddedScriptPath)
-		os.RemoveAll(cacheDir)
+		scriptDir := filepath.Dir(rb.embeddedScriptPath)
+		os.RemoveAll(scriptDir)
 		rb.embeddedScriptPath = ""
 		rb.embeddedScriptReady = false
 	}
@@ -157,7 +180,7 @@ func (rb *ResourceBuilder) BuildWithContext(ctx context.Context, task BuildTask)
 	var err error
 	var output string
 
-	if task.Type != TypeViews {
+	if task.Type != TypeViews && task.Type != TypeCopy {
 		if autoloadErr := rb.generateAutoloadControllers(task.Path); autoloadErr != nil {
 			duration := time.Since(start)
 			return BuildResult{
@@ -168,6 +191,8 @@ func (rb *ResourceBuilder) BuildWithContext(ctx context.Context, task BuildTask)
 				Output:   "",
 			}
 		}
+
+		rb.RunTypegen(task.Path)
 	}
 
 	switch task.Type {
@@ -310,7 +335,7 @@ func (rb *ResourceBuilder) copyResource(task BuildTask) (string, error) {
 }
 
 func (rb *ResourceBuilder) copyResourceWithContext(ctx context.Context, task BuildTask) (string, error) {
-	scriptPath, err := rb.getBuildScriptPath(task)
+	scriptPath, err := rb.ensureEmbeddedScript()
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/builder/resource_builder_test.go b/internal/builder/resource_builder_test.go
index 8b15217..2eba50c 100644
--- a/internal/builder/resource_builder_test.go
+++ b/internal/builder/resource_builder_test.go
@@ -313,6 +313,12 @@ func TestCopyResource(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(srcDir, "subdir", "file2.lua"), []byte("-- nested"), 0644); err != nil {
 		t.Fatal(err)
 	}
+	if err := os.WriteFile(filepath.Join(srcDir, ".ocignore"), []byte("subdir/private/**\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	writeTestFile(t, srcDir, "subdir/private/secret.txt", "secret")
+	writeTestFile(t, srcDir, "subdir/node_modules/pkg/index.js", "ignored")
+	writeTestFile(t, srcDir, "subdir/package.json", `{}`)
 
 	// node_modules inside resource (should be skipped)
 	if err := os.MkdirAll(filepath.Join(srcDir, "node_modules"), 0755); err != nil {
@@ -350,6 +356,11 @@ func TestCopyResource(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(dstDir, "subdir", "file2.lua")); os.IsNotExist(err) {
 		t.Error("subdir/file2.lua should be copied")
 	}
+	for _, ignored := range []string{"subdir/private", "subdir/node_modules", "subdir/package.json"} {
+		if _, err := os.Stat(filepath.Join(dstDir, ignored)); !os.IsNotExist(err) {
+			t.Errorf("%s should be filtered recursively", ignored)
+		}
+	}
 
 	// Verify node_modules junction/symlink was created by handleDependencies
 	modsPath := filepath.Join(dstDir, "node_modules")
@@ -399,6 +410,28 @@ func TestCopyFile(t *testing.T) {
 	}
 }
 
+func TestCleanupPreservesDependencyCache(t *testing.T) {
+	root := t.TempDir()
+	rb := NewResourceBuilder(root)
+	if _, err := rb.ensureEmbeddedScript(); err != nil {
+		t.Fatal(err)
+	}
+	dependencyCache := filepath.Join(root, "node_modules", ".cache", "opencore", "dependencies", "key", ".ready")
+	if err := os.MkdirAll(filepath.Dir(dependencyCache), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(dependencyCache, []byte("ready"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	rb.Cleanup()
+	if _, err := os.Stat(dependencyCache); err != nil {
+		t.Fatalf("Cleanup removed dependency cache: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(root, "node_modules", ".cache", "opencore", "scripts")); !os.IsNotExist(err) {
+		t.Fatalf("Cleanup did not remove extracted scripts: %v", err)
+	}
+}
+
 func TestBuildTaskTypes(t *testing.T) {
 	if _, err := exec.LookPath("node"); err != nil {
 		t.Skip("skipping: node is not installed")
diff --git a/internal/builder/source_validation_test.go b/internal/builder/source_validation_test.go
index 15af925..633f812 100644
--- a/internal/builder/source_validation_test.go
+++ b/internal/builder/source_validation_test.go
@@ -242,3 +242,27 @@ export class IgnoredController {}
 		t.Fatalf("client autoload includes unexpected imports: %s", clientText)
 	}
 }
+
+func TestGenerateAutoloadControllersIgnoresCommentsAndStrings(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+	writeTestFile(t, resourcePath, "src/not-controller.ts", `
+// @Server.Controller()
+const docs = "@Client.Controller()"
+const fakeImport = "from '@open-core/framework/server'"
+/* @Controller() */
+export class NotAController {}
+`)
+	if err := rb.generateAutoloadControllers(resourcePath); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"autoload.server.controllers.ts", "autoload.client.controllers.ts"} {
+		content, err := os.ReadFile(filepath.Join(resourcePath, ".opencore", name))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if string(content) != "export {};\n" {
+			t.Fatalf("%s included a fake controller: %s", name, content)
+		}
+	}
+}
diff --git a/internal/builder/typecheck.go b/internal/builder/typecheck.go
new file mode 100644
index 0000000..b0db553
--- /dev/null
+++ b/internal/builder/typecheck.go
@@ -0,0 +1,147 @@
+package builder
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/newcore-network/opencore-cli/internal/ui"
+)
+
+const typecheckConfigFile = "tsconfig.json"
+
+// typecheckErrorPattern matches one diagnostic line of `tsc --pretty false`.
+var typecheckErrorPattern = regexp.MustCompile(`(?m)^.*error TS\d+:`)
+
+// TypecheckResult is the outcome of one `tsc --noEmit` run over the project.
+type TypecheckResult struct {
+	// Output is tsc's diagnostics, trimmed; empty when the project type-checks.
+	Output     string
+	ErrorCount int
+	Duration   time.Duration
+}
+
+func (r TypecheckResult) Passed() bool {
+	return r.ErrorCount == 0
+}
+
+// tscEntryPoint locates the project's own TypeScript, so diagnostics match the version the
+// project's editor uses.
+func tscEntryPoint(projectPath string) (string, error) {
+	tsc := filepath.Join(projectPath, "node_modules", "typescript", "bin", "tsc")
+	if _, err := os.Stat(tsc); err != nil {
+		return "", fmt.Errorf("build.typecheck requires typescript in the project (%s not found)", tsc)
+	}
+	return tsc, nil
+}
+
+// RunTypecheck type-checks the project through its root tsconfig.json. The error is reserved for
+// failing to run tsc at all; type errors are reported through the result.
+func RunTypecheck(ctx context.Context, projectPath string) (TypecheckResult, error) {
+	start := time.Now()
+
+	tsconfig := filepath.Join(projectPath, typecheckConfigFile)
+	if _, err := os.Stat(tsconfig); err != nil {
+		return TypecheckResult{}, fmt.Errorf("build.typecheck requires %s: %w", tsconfig, err)
+	}
+	tsc, err := tscEntryPoint(projectPath)
+	if err != nil {
+		return TypecheckResult{}, err
+	}
+
+	cmd := exec.CommandContext(ctx, "node", tsc, "-p", tsconfig, "--noEmit", "--pretty", "false")
+	cmd.Dir = projectPath
+	var output bytes.Buffer
+	cmd.Stdout = &output
+	cmd.Stderr = &output
+
+	runErr := cmd.Run()
+	result := TypecheckResult{
+		Output:   strings.TrimSpace(output.String()),
+		Duration: time.Since(start),
+	}
+	result.ErrorCount = len(typecheckErrorPattern.FindAllString(result.Output, -1))
+
+	var exitErr *exec.ExitError
+	switch {
+	case runErr == nil:
+		return result, nil
+	case ctx.Err() != nil:
+		return result, ctx.Err()
+	case errors.As(runErr, &exitErr) && result.ErrorCount > 0:
+		// tsc exits non-zero whenever it reports diagnostics.
+		return result, nil
+	default:
+		return result, fmt.Errorf("tsc failed: %w\n%s", runErr, result.Output)
+	}
+}
+
+// SetTypecheckWarnOnly makes type errors print as warnings instead of failing the build. Used by
+// `opencore dev`, where a type error should not stop the watch loop.
+func (b *Builder) SetTypecheckWarnOnly(warnOnly bool) {
+	b.typecheckWarnOnly = warnOnly
+}
+
+// typecheck runs when build.typecheck is enabled, before anything is bundled: the output
+// directory is usually the deploy destination itself, so checking afterwards would already have
+// shipped the failing code. It regenerates types first so the check sees current `.gen.ts` files.
+func (b *Builder) typecheck(ctx context.Context, tasks []BuildTask, plain bool) error {
+	if !b.config.Build.TypecheckEnabled() {
+		return nil
+	}
+
+	b.regenerateTypes(tasks)
+
+	if plain {
+		fmt.Println("\nType checking...")
+	} else {
+		fmt.Printf("\n%s Type checking...\n", ui.Info("→"))
+	}
+
+	result, err := RunTypecheck(ctx, b.resourceBuilder.projectPath)
+	if err != nil {
+		if b.typecheckWarnOnly && ctx.Err() == nil {
+			fmt.Println(ui.Warning(fmt.Sprintf("Type check skipped: %v", err)))
+			return nil
+		}
+		return err
+	}
+
+	if result.Passed() {
+		message := fmt.Sprintf("Type check passed (%s)", result.Duration.Round(time.Millisecond))
+		if plain {
+			fmt.Println(message)
+		} else {
+			fmt.Println(ui.Success(message))
+		}
+		return nil
+	}
+
+	fmt.Println(result.Output)
+	summary := fmt.Sprintf("type check failed: %d error(s)", result.ErrorCount)
+	if b.typecheckWarnOnly {
+		fmt.Println(ui.Warning(summary))
+		return nil
+	}
+	return errors.New(summary)
+}
+
+// regenerateTypes runs typegen for every resource the tasks touch. Bundling runs it again per
+// task, which is a no-op once the files are current.
+func (b *Builder) regenerateTypes(tasks []BuildTask) {
+	seen := make(map[string]bool, len(tasks))
+	for _, task := range tasks {
+		if task.Type == TypeViews || task.Type == TypeCopy || seen[task.Path] {
+			continue
+		}
+		seen[task.Path] = true
+		b.resourceBuilder.RunTypegen(task.Path)
+	}
+}
diff --git a/internal/builder/typecheck_test.go b/internal/builder/typecheck_test.go
new file mode 100644
index 0000000..0f4ca90
--- /dev/null
+++ b/internal/builder/typecheck_test.go
@@ -0,0 +1,109 @@
+package builder
+
+import (
+	"context"
+	"os/exec"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/newcore-network/opencore-cli/internal/config"
+)
+
+// fakeTypecheckProject lays out a project whose "tsc" prints output and exits with code.
+func fakeTypecheckProject(t *testing.T, output string, code int) string {
+	t.Helper()
+	if _, err := exec.LookPath("node"); err != nil {
+		t.Skip("node is not installed")
+	}
+
+	project := t.TempDir()
+	writeTestFile(t, project, "tsconfig.json", "{}")
+	writeTestFile(t, project, "node_modules/typescript/bin/tsc", "process.stdout.write("+
+		quoteJS(output)+"); process.exit("+strconv.Itoa(code)+")\n")
+	return project
+}
+
+func quoteJS(s string) string {
+	return "'" + strings.NewReplacer(`\`, `\\`, "'", `\'`, "\n", `\n`).Replace(s) + "'"
+}
+
+func TestRunTypecheck_Passes(t *testing.T) {
+	project := fakeTypecheckProject(t, "", 0)
+
+	result, err := RunTypecheck(context.Background(), project)
+	if err != nil {
+		t.Fatalf("RunTypecheck returned error: %v", err)
+	}
+	if !result.Passed() {
+		t.Fatalf("expected a pass, got %+v", result)
+	}
+}
+
+func TestRunTypecheck_CountsDiagnostics(t *testing.T) {
+	output := "src/a.ts(1,1): error TS2345: Argument of type '\"no:existe\"' is not assignable.\n" +
+		"src/b.ts(2,5): error TS2322: Type 'string' is not assignable to type 'number'.\n"
+	project := fakeTypecheckProject(t, output, 2)
+
+	result, err := RunTypecheck(context.Background(), project)
+	if err != nil {
+		t.Fatalf("type errors must be reported through the result, got error: %v", err)
+	}
+	if result.Passed() || result.ErrorCount != 2 {
+		t.Fatalf("expected 2 errors, got %+v", result)
+	}
+	if !strings.Contains(result.Output, "no:existe") {
+		t.Fatalf("expected tsc's output to be kept, got %q", result.Output)
+	}
+}
+
+func TestRunTypecheck_FailsWhenTscCrashes(t *testing.T) {
+	project := fakeTypecheckProject(t, "unexpected crash", 1)
+
+	if _, err := RunTypecheck(context.Background(), project); err == nil {
+		t.Fatal("expected an error when tsc exits non-zero without diagnostics")
+	}
+}
+
+func TestRunTypecheck_RequiresTypescript(t *testing.T) {
+	project := t.TempDir()
+	writeTestFile(t, project, "tsconfig.json", "{}")
+
+	_, err := RunTypecheck(context.Background(), project)
+	if err == nil || !strings.Contains(err.Error(), "requires typescript") {
+		t.Fatalf("expected a missing-typescript error, got %v", err)
+	}
+}
+
+func typecheckBuilder(project string, enabled bool) *Builder {
+	cfg := &config.Config{Build: config.BuildConfig{Typecheck: &enabled}}
+	b := New(cfg)
+	b.resourceBuilder.projectPath = project
+	return b
+}
+
+func TestBuilderTypecheck_FailsTheBuildOnErrors(t *testing.T) {
+	project := fakeTypecheckProject(t, "src/a.ts(1,1): error TS2345: bad\n", 2)
+
+	err := typecheckBuilder(project, true).typecheck(context.Background(), nil, true)
+	if err == nil || !strings.Contains(err.Error(), "1 error(s)") {
+		t.Fatalf("expected the build to fail, got %v", err)
+	}
+}
+
+func TestBuilderTypecheck_WarnOnlyKeepsGoing(t *testing.T) {
+	project := fakeTypecheckProject(t, "src/a.ts(1,1): error TS2345: bad\n", 2)
+
+	b := typecheckBuilder(project, true)
+	b.SetTypecheckWarnOnly(true)
+	if err := b.typecheck(context.Background(), nil, true); err != nil {
+		t.Fatalf("warn-only mode must not fail, got %v", err)
+	}
+}
+
+func TestBuilderTypecheck_DisabledSkipsTsc(t *testing.T) {
+	// No tsconfig and no typescript: running tsc would fail, so passing proves it was skipped.
+	if err := typecheckBuilder(t.TempDir(), false).typecheck(context.Background(), nil, true); err != nil {
+		t.Fatalf("expected the check to be skipped, got %v", err)
+	}
+}
diff --git a/internal/builder/typegen.go b/internal/builder/typegen.go
new file mode 100644
index 0000000..8fe335b
--- /dev/null
+++ b/internal/builder/typegen.go
@@ -0,0 +1,1200 @@
+package builder
+
+import (
+	"cmp"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/newcore-network/opencore-cli/internal/ui"
+)
+
+var (
+	// Decorator heads. The argument list is extracted separately via a balanced-paren scan so
+	// that declarations spanning multiple lines are handled.
+	serverOnNetHead   = regexp.MustCompile(`@Server\.OnNet\s*\(`)
+	serverOnRPCHead   = regexp.MustCompile(`@Server\.OnRPC\s*\(`)
+	serverCommandHead = regexp.MustCompile(`@Server\.Command\s*\(`)
+	clientOnNetHead   = regexp.MustCompile(`@Client\.OnNet\s*\(`)
+	clientOnRPCHead   = regexp.MustCompile(`@Client\.OnRPC\s*\(`)
+
+	// `export class Foo`, `class Foo`, `export default class Foo`.
+	classDeclPattern = regexp.MustCompile(`(?m)^\s*(?:export\s+)?(?:default\s+)?(?:abstract\s+)?class\s+([A-Za-z_$][A-Za-z0-9_$]*)`)
+
+	// A method declaration line: optional modifiers, a name, optional type params, then `(`.
+	methodDeclPattern = regexp.MustCompile(`^\s*(?:(?:public|private|protected|readonly|static|async|override)\s+)*([A-Za-z_$][A-Za-z0-9_$]*)\s*(?:<[^>]*>)?\s*\(`)
+
+	// First single/double/back-quoted literal inside a decorator's argument list.
+	stringLiteralPattern = regexp.MustCompile("^\\s*(?:'([^']*)'|\"([^\"]*)\"|`([^`$\\\\]*)`)")
+
+	// A dotted identifier reference such as `CharacterNetEvents.UI_OPEN`, which is how event
+	// names are written in practice once a project keeps them in a shared const object.
+	identifierRefPattern = regexp.MustCompile(`^\s*([A-Za-z_$][A-Za-z0-9_$]*)((?:\s*\.\s*[A-Za-z_$][A-Za-z0-9_$]*)*)\s*(?:,|\)|$)`)
+
+	// `import { A, B as C } from 'spec'` / `import type { … } from 'spec'`.
+	namedImportPattern = regexp.MustCompile(`(?m)^\s*import\s+(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]`)
+	// `import * as NS from 'spec'`.
+	namespaceImportPattern = regexp.MustCompile(`(?m)^\s*import\s+(?:type\s+)?\*\s+as\s+([A-Za-z_$][A-Za-z0-9_$]*)\s+from\s*['"]([^'"]+)['"]`)
+	// `import Default from 'spec'`.
+	defaultImportPattern = regexp.MustCompile(`(?m)^\s*import\s+(?:type\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*(?:,\s*\{[^}]*\})?\s*from\s*['"]([^'"]+)['"]`)
+
+	// `someView.send(` / `WebView.send(` — the client pushing a message into a WebView.
+	webViewSendPattern = regexp.MustCompile(`(?:this\s*\.\s*)?([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*send\s*\(`)
+
+	// `@Client.OnView(` — a handler for messages arriving from a WebView.
+	clientOnViewHead = regexp.MustCompile(`@Client\.OnView\s*\(`)
+
+	// `export const NAME =` — a constant this file exposes to the generated module.
+	exportedConstPattern = regexp.MustCompile(`(?m)^\s*export\s+const\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=`)
+	// `const NAME = 'literal'` — a file-local constant we can inline directly.
+	localStringConstPattern = regexp.MustCompile("(?m)^\\s*(?:export\\s+)?const\\s+([A-Za-z_$][A-Za-z0-9_$]*)\\s*(?::[^=]+)?=\\s*(?:'([^']*)'|\"([^\"]*)\"|`([^`$\\\\]*)`)\\s*(?:as\\s+const\\s*)?;?\\s*$")
+
+	// `command: 'name'` inside a @Server.Command config object.
+	commandFieldPattern     = regexp.MustCompile("command\\s*:\\s*(?:'([^']*)'|\"([^\"]*)\"|`([^`$\\\\]*)`)")
+	descriptionFieldPattern = regexp.MustCompile("description\\s*:\\s*(?:'([^']*)'|\"([^\"]*)\"|`([^`$\\\\]*)`)")
+	usageFieldPattern       = regexp.MustCompile("usage\\s*:\\s*(?:'([^']*)'|\"([^\"]*)\"|`([^`$\\\\]*)`)")
+)
+
+// Names that look like a method declaration but are control flow or a constructor.
+var nonMethodNames = map[string]bool{
+	"constructor": true,
+	"if":          true,
+	"for":         true,
+	"while":       true,
+	"switch":      true,
+	"catch":       true,
+	"return":      true,
+	"function":    true,
+	"do":          true,
+}
+
+// typegenKind identifies which Register map an entry feeds.
+type typegenKind string
+
+const (
+	kindServerNet typegenKind = "serverEvents"
+	kindClientNet typegenKind = "clientEvents"
+	kindServerRPC typegenKind = "serverRpc"
+	kindClientRPC typegenKind = "clientRpc"
+	kindCommand   typegenKind = "commands"
+)
+
+// typegenEntry is one decorated handler discovered during the scan.
+type typegenEntry struct {
+	Kind       typegenKind
+	EventName  string // source text of the name, used for ordering and de-duplication
+	ImportPath string // relative to the .opencore directory, extension stripped
+	ClassName  string
+	MethodName string
+	// KeyType is a TypeScript type expression for the event-name key. Empty means EventName is
+	// a plain literal and can be quoted directly.
+	KeyType     string
+	Description string
+	Usage       string
+	// SourceFile and SourceLine locate the decorator, for diagnostics only.
+	SourceFile string
+	SourceLine int
+}
+
+// fileSymbols captures the bindings of one source file that the name resolver needs.
+type fileSymbols struct {
+	// importedFrom maps a local binding to its module and exported binding.
+	importedFrom map[string]importBinding
+	// exportedConsts holds names reachable through `typeof import(...)` on the file itself.
+	exportedConsts map[string]bool
+	// localStrings holds constants with a plain string initialiser, inlinable even when private.
+	localStrings map[string]string
+}
+
+type importBinding struct {
+	spec     string
+	exported string
+}
+
+func parseFileSymbols(text string) *fileSymbols {
+	return &fileSymbols{
+		importedFrom:   collectImportBindings(text),
+		exportedConsts: collectExportedConsts(text),
+		localStrings:   collectLocalStringConsts(text),
+	}
+}
+
+func collectImportBindings(text string) map[string]importBinding {
+	bindings := map[string]importBinding{}
+
+	for _, m := range namedImportPattern.FindAllStringSubmatch(text, -1) {
+		for clause := range strings.SplitSeq(m[1], ",") {
+			if imported, local := importNamesOf(clause); local != "" {
+				bindings[local] = importBinding{spec: m[2], exported: imported}
+			}
+		}
+	}
+	for _, m := range namespaceImportPattern.FindAllStringSubmatch(text, -1) {
+		bindings[m[1]] = importBinding{spec: m[2]}
+	}
+	for _, m := range defaultImportPattern.FindAllStringSubmatch(text, -1) {
+		if _, exists := bindings[m[1]]; !exists {
+			bindings[m[1]] = importBinding{spec: m[2], exported: "default"}
+		}
+	}
+
+	return bindings
+}
+
+func importNamesOf(clause string) (imported, local string) {
+	imported = strings.TrimPrefix(strings.TrimSpace(clause), "type ")
+	local = imported
+	if original, alias, renamed := strings.Cut(imported, " as "); renamed {
+		imported, local = original, alias
+	}
+	return strings.TrimSpace(imported), strings.TrimSpace(local)
+}
+
+func collectExportedConsts(text string) map[string]bool {
+	consts := map[string]bool{}
+	for _, m := range exportedConstPattern.FindAllStringSubmatch(text, -1) {
+		consts[m[1]] = true
+	}
+	return consts
+}
+
+func collectLocalStringConsts(text string) map[string]string {
+	consts := map[string]string{}
+	for _, m := range localStringConstPattern.FindAllStringSubmatch(text, -1) {
+		if literal, ok := firstNonEmpty(m[2:]); ok {
+			consts[m[1]] = literal
+		}
+	}
+	return consts
+}
+
+func firstNonEmpty(groups []string) (string, bool) {
+	for _, group := range groups {
+		if group != "" {
+			return group, true
+		}
+	}
+	return "", false
+}
+
+func resolveModuleImportPath(spec string, sourceFile string, baseDir string) (string, bool) {
+	if !strings.HasPrefix(spec, ".") {
+		return spec, true
+	}
+
+	absolute := filepath.Join(filepath.Dir(sourceFile), spec)
+	rel, err := filepath.Rel(baseDir, absolute)
+	if err != nil {
+		return "", false
+	}
+	rel = filepath.ToSlash(rel)
+	if !strings.HasPrefix(rel, ".") {
+		rel = "./" + rel
+	}
+	return rel, true
+}
+
+func resolveEventNameExpression(
+	args string,
+	syms *fileSymbols,
+	sourceFile string,
+	selfImportPath string,
+	baseDir string,
+) (keyType string, display string, ok bool) {
+	m := identifierRefPattern.FindStringSubmatch(args)
+	if m == nil {
+		return "", "", false
+	}
+
+	base := m[1]
+	var props []string
+	for part := range strings.SplitSeq(m[2], ".") {
+		if part = strings.TrimSpace(part); part != "" {
+			props = append(props, part)
+		}
+	}
+
+	display = dottedName(base, props)
+
+	if literal, inlinable := syms.inlinableLocalConst(base, props); inlinable {
+		return "", literal, true
+	}
+
+	moduleExpr, ok := syms.moduleExprFor(base, sourceFile, selfImportPath, baseDir)
+	if !ok {
+		return "", display, false
+	}
+
+	for _, prop := range props {
+		moduleExpr += fmt.Sprintf("[%s]", quoteTSString(prop))
+	}
+
+	return moduleExpr, display, true
+}
+
+func dottedName(base string, props []string) string {
+	if len(props) == 0 {
+		return base
+	}
+	return base + "." + strings.Join(props, ".")
+}
+
+func (s *fileSymbols) inlinableLocalConst(base string, props []string) (string, bool) {
+	if len(props) > 0 {
+		return "", false
+	}
+	literal, found := s.localStrings[base]
+	return literal, found
+}
+
+func (s *fileSymbols) moduleExprFor(
+	base string,
+	sourceFile string,
+	selfImportPath string,
+	baseDir string,
+) (string, bool) {
+	if binding, imported := s.importedFrom[base]; imported {
+		resolved, resolvable := resolveModuleImportPath(binding.spec, sourceFile, baseDir)
+		if !resolvable {
+			return "", false
+		}
+		expr := fmt.Sprintf("typeof import(%s)", quoteTSString(resolved))
+		if binding.exported != "" {
+			expr += "." + binding.exported
+		}
+		return expr, true
+	}
+	if s.exportedConsts[base] {
+		return fmt.Sprintf("typeof import(%s).%s", quoteTSString(selfImportPath), base), true
+	}
+	return "", false
+}
+
+type TypegenResult struct {
+	Entries  []typegenEntry
+	Warnings []SourceValidationIssue
+	// Changed is false when the emitted content matched what was already on disk.
+	Changed bool
+}
+
+type TypegenOptions struct {
+	// Strict makes unknown event names a compile error in the consuming project.
+	Strict bool
+	// FrameworkPackage is the module specifier to augment. Defaults to "@open-core/framework".
+	FrameworkPackage string
+	// ResourceKey is the `Register` key this resource's maps are filed under. Set per resource by
+	// generateTypes; see resourceRegisterKey.
+	ResourceKey string
+}
+
+const defaultFrameworkPackage = "@open-core/framework"
+const typegenFileName = "opencore.gen.ts"
+
+// registerModuleSuffix is the subpath that *declares* the `Register` interface.
+//
+// The augmentation must target the declaring module, not the package root. `Register` is only
+// re-exported by the root entry, and TypeScript's declaration merging does not follow
+// re-exports: augmenting '@open-core/framework' would silently create a second, unrelated
+// interface and every narrowing would quietly fall back to `string`.
+const registerModuleSuffix = "/register"
+
+func extractDecoratorArgs(text string, openIdx int) (string, int, bool) {
+	depth := 0
+	var quote byte
+	inQuote := false
+
+	for i := openIdx; i < len(text); i++ {
+		c := text[i]
+
+		if inQuote {
+			if c == '\\' {
+				i++
+				continue
+			}
+			if c == quote {
+				inQuote = false
+			}
+			continue
+		}
+
+		switch c {
+		case '\'', '"', '`':
+			inQuote = true
+			quote = c
+		case '(':
+			depth++
+		case ')':
+			depth--
+			if depth == 0 {
+				return text[openIdx+1 : i], i, true
+			}
+		}
+	}
+
+	return "", 0, false
+}
+
+func firstStringLiteral(args string) (string, bool) {
+	return matchField(stringLiteralPattern, args)
+}
+
+func matchField(pattern *regexp.Regexp, text string) (string, bool) {
+	m := pattern.FindStringSubmatch(text)
+	if m == nil {
+		return "", false
+	}
+	return firstNonEmpty(m[1:])
+}
+
+func methodNameAfter(text string, endIdx int) (string, bool) {
+	for line := range strings.SplitSeq(text[endIdx:], "\n") {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || strings.HasPrefix(trimmed, "@") || strings.HasPrefix(trimmed, ")") {
+			continue
+		}
+		m := methodDeclPattern.FindStringSubmatch(line)
+		if m == nil || nonMethodNames[m[1]] {
+			return "", false
+		}
+		return m[1], true
+	}
+	return "", false
+}
+
+type scanState int
+
+const (
+	stateCode scanState = iota
+	stateLineComment
+	stateBlockComment
+	stateQuoted
+)
+
+func blankComments(text string) string {
+	blanker := &commentBlanker{out: []byte(text), state: stateCode}
+	return blanker.run()
+}
+
+type commentBlanker struct {
+	out       []byte
+	state     scanState
+	quoteChar byte
+	i         int
+}
+
+func (b *commentBlanker) run() string {
+	for b.i = 0; b.i < len(b.out); b.i++ {
+		switch b.state {
+		case stateCode:
+			b.stepCode()
+		case stateLineComment:
+			b.stepLineComment()
+		case stateBlockComment:
+			b.stepBlockComment()
+		case stateQuoted:
+			b.stepQuoted()
+		}
+	}
+	return string(b.out)
+}
+
+func (b *commentBlanker) stepCode() {
+	switch {
+	case b.opensWith('/'):
+		b.state = stateLineComment
+	case b.opensWith('*'):
+		b.state = stateBlockComment
+	case b.isQuote():
+		b.state = stateQuoted
+		b.quoteChar = b.out[b.i]
+		return
+	default:
+		return
+	}
+	b.blankPair()
+}
+
+func (b *commentBlanker) stepLineComment() {
+	if b.out[b.i] == '\n' {
+		b.state = stateCode
+		return
+	}
+	b.blank(b.i)
+}
+
+func (b *commentBlanker) stepBlockComment() {
+	closing := b.out[b.i] == '*' && b.peekIs('/')
+	b.blank(b.i)
+	if closing {
+		b.blankPair()
+		b.state = stateCode
+	}
+}
+
+func (b *commentBlanker) stepQuoted() {
+	switch b.out[b.i] {
+	case '\\':
+		b.i++
+	case b.quoteChar:
+		b.state = stateCode
+	}
+}
+
+func (b *commentBlanker) opensWith(marker byte) bool {
+	return b.out[b.i] == '/' && b.peekIs(marker)
+}
+
+func (b *commentBlanker) peekIs(c byte) bool {
+	return b.i+1 < len(b.out) && b.out[b.i+1] == c
+}
+
+func (b *commentBlanker) isQuote() bool {
+	c := b.out[b.i]
+	return c == '\'' || c == '"' || c == '`'
+}
+
+func (b *commentBlanker) blankPair() {
+	b.blank(b.i)
+	b.blank(b.i + 1)
+	b.i++
+}
+
+func (b *commentBlanker) blank(i int) {
+	if b.out[i] != '\n' && b.out[i] != '\r' {
+		b.out[i] = ' '
+	}
+}
+
+type classInfo struct {
+	name   string
+	offset int
+}
+
+func collectClasses(text string) []classInfo {
+	var classes []classInfo
+	for _, loc := range classDeclPattern.FindAllStringSubmatchIndex(text, -1) {
+		if loc[2] < 0 {
+			continue
+		}
+		classes = append(classes, classInfo{name: text[loc[2]:loc[3]], offset: loc[0]})
+	}
+	return classes
+}
+
+func enclosingClass(classes []classInfo, offset int) string {
+	name := classes[0].name
+	for _, class := range classes {
+		if class.offset > offset {
+			break
+		}
+		name = class.name
+	}
+	return name
+}
+
+// lineOf reports the 1-based line number of a byte offset.
+func lineOf(text string, offset int) int {
+	if offset > len(text) {
+		offset = len(text)
+	}
+	return strings.Count(text[:offset], "\n") + 1
+}
+
+type decoratorSpec struct {
+	head *regexp.Regexp
+	kind typegenKind
+}
+
+var typegenDecorators = []decoratorSpec{
+	{serverOnNetHead, kindServerNet},
+	{clientOnNetHead, kindClientNet},
+	{serverOnRPCHead, kindServerRPC},
+	{clientOnRPCHead, kindClientRPC},
+	{serverCommandHead, kindCommand},
+}
+
+type fileScan struct {
+	text       string
+	relPath    string
+	importPath string
+	sourceFile string
+	baseDir    string
+	classes    []classInfo
+	syms       *fileSymbols
+}
+
+func scanFileForTypegen(
+	text string,
+	relPath string,
+	importPath string,
+	sourceFile string,
+	baseDir string,
+) ([]typegenEntry, []SourceValidationIssue) {
+	blanked := blankComments(text)
+
+	classes := collectClasses(blanked)
+	if len(classes) == 0 {
+		return nil, nil
+	}
+
+	scan := &fileScan{
+		text:       blanked,
+		relPath:    relPath,
+		importPath: importPath,
+		sourceFile: sourceFile,
+		baseDir:    baseDir,
+		classes:    classes,
+		syms:       parseFileSymbols(blanked),
+	}
+
+	var entries []typegenEntry
+	var warnings []SourceValidationIssue
+
+	for _, spec := range typegenDecorators {
+		for _, loc := range spec.head.FindAllStringIndex(scan.text, -1) {
+			entry, warning := scan.entryAt(spec, loc[0], loc[1]-1)
+			if warning != nil {
+				warnings = append(warnings, *warning)
+				continue
+			}
+			entries = append(entries, *entry)
+		}
+	}
+
+	return entries, warnings
+}
+
+func (s *fileScan) entryAt(spec decoratorSpec, start int, openIdx int) (*typegenEntry, *SourceValidationIssue) {
+	args, endIdx, balanced := extractDecoratorArgs(s.text, openIdx)
+	if !balanced {
+		return nil, s.issue(start, "unbalanced parentheses in decorator; skipped by typegen")
+	}
+
+	name, issue := s.resolveName(spec.kind, args, start)
+	if issue != nil {
+		return nil, issue
+	}
+
+	methodName, found := methodNameAfter(s.text, endIdx+1)
+	if !found {
+		return nil, s.issuef(start,
+			"could not resolve the method decorated for %q; skipped by typegen", name.event)
+	}
+
+	metadata := commandMetadata(spec.kind, args)
+
+	return &typegenEntry{
+		Kind:        spec.kind,
+		EventName:   name.event,
+		KeyType:     name.keyType,
+		ImportPath:  s.importPath,
+		ClassName:   enclosingClass(s.classes, start),
+		MethodName:  methodName,
+		Description: metadata.description,
+		Usage:       metadata.usage,
+		SourceFile:  s.relPath,
+		SourceLine:  lineOf(s.text, start),
+	}, nil
+}
+
+type resolvedName struct {
+	event   string
+	keyType string
+}
+
+func (s *fileScan) resolveName(kind typegenKind, args string, start int) (resolvedName, *SourceValidationIssue) {
+	if literal, ok := firstStringLiteral(args); ok {
+		return resolvedName{event: literal}, nil
+	}
+	if kind == kindCommand {
+		if configured, ok := matchField(commandFieldPattern, args); ok {
+			return resolvedName{event: configured}, nil
+		}
+	}
+
+	keyType, display, ok := resolveEventNameExpression(args, s.syms, s.sourceFile, s.importPath, s.baseDir)
+	if !ok {
+		return resolvedName{}, s.issuef(start,
+			"could not resolve the event name %q; skipped by typegen (use a string literal or an imported const)",
+			strings.TrimSpace(display))
+	}
+	return resolvedName{event: display, keyType: keyType}, nil
+}
+
+type commandFields struct {
+	description string
+	usage       string
+}
+
+func commandMetadata(kind typegenKind, args string) commandFields {
+	if kind != kindCommand {
+		return commandFields{}
+	}
+	description, _ := matchField(descriptionFieldPattern, args)
+	usage, _ := matchField(usageFieldPattern, args)
+	return commandFields{description: description, usage: usage}
+}
+
+func (s *fileScan) issue(offset int, message string) *SourceValidationIssue {
+	return &SourceValidationIssue{
+		File:    s.relPath,
+		Line:    lineOf(s.text, offset),
+		Message: message,
+	}
+}
+
+func (s *fileScan) issuef(offset int, format string, args ...any) *SourceValidationIssue {
+	return s.issue(offset, fmt.Sprintf(format, args...))
+}
+
+func walkSourceFiles(resourcePath string, viewPath string, visit func(path string, text string) error) error {
+	skipDir := newViewDirSkipper(viewPath)
+
+	return filepath.WalkDir(resourcePath, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			if skipDir(path, d.Name()) {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		if !isScannableSource(d.Name()) {
+			return nil
+		}
+
+		content, readErr := os.ReadFile(path)
+		if readErr != nil {
+			return readErr
+		}
+		return visit(path, string(content))
+	})
+}
+
+func isScannableSource(name string) bool {
+	return strings.HasSuffix(name, ".ts") && !strings.HasSuffix(name, ".d.ts")
+}
+
+func containsDecorators(text string) bool {
+	return strings.Contains(text, "@Server.") || strings.Contains(text, "@Client.")
+}
+
+func relativeSourcePath(root string, path string) string {
+	rel, err := filepath.Rel(root, path)
+	if err != nil {
+		return path
+	}
+	return filepath.ToSlash(rel)
+}
+
+func moduleImportPath(baseDir string, path string) (string, error) {
+	rel, err := filepath.Rel(baseDir, path)
+	if err != nil {
+		return "", err
+	}
+	spec := filepath.ToSlash(rel)
+	if !strings.HasPrefix(spec, ".") {
+		spec = "./" + spec
+	}
+	return strings.TrimSuffix(spec, ".ts"), nil
+}
+
+// scanResourceForTypegen walks a resource and collects every typegen entry in it.
+func scanResourceForTypegen(resourcePath string, baseDir string, viewPath string) ([]typegenEntry, []SourceValidationIssue, error) {
+	var entries []typegenEntry
+	var warnings []SourceValidationIssue
+
+	err := walkSourceFiles(resourcePath, viewPath, func(path string, text string) error {
+		if !containsDecorators(text) {
+			return nil
+		}
+
+		importPath, err := moduleImportPath(baseDir, path)
+		if err != nil {
+			return err
+		}
+
+		fileEntries, fileWarnings := scanFileForTypegen(
+			text, relativeSourcePath(resourcePath, path), importPath, path, baseDir,
+		)
+		entries = append(entries, fileEntries...)
+		warnings = append(warnings, fileWarnings...)
+		return nil
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	sortEntriesDeterministically(entries)
+	warnings = append(warnings, duplicateEntryWarnings(entries)...)
+	sortValidationIssues(warnings)
+
+	return entries, warnings, nil
+}
+
+func sortValidationIssues(issues []SourceValidationIssue) {
+	slices.SortStableFunc(issues, func(a, b SourceValidationIssue) int {
+		return cmp.Or(
+			strings.Compare(a.File, b.File),
+			cmp.Compare(a.Line, b.Line),
+			strings.Compare(a.Message, b.Message),
+		)
+	})
+}
+
+func sortEntriesDeterministically(entries []typegenEntry) {
+	slices.SortStableFunc(entries, func(a, b typegenEntry) int {
+		return cmp.Or(
+			strings.Compare(string(a.Kind), string(b.Kind)),
+			strings.Compare(a.EventName, b.EventName),
+			strings.Compare(a.ImportPath, b.ImportPath),
+			strings.Compare(a.ClassName, b.ClassName),
+			strings.Compare(a.MethodName, b.MethodName),
+		)
+	})
+}
+
+func isSameHandler(a typegenEntry, b typegenEntry) bool {
+	return a.ImportPath == b.ImportPath && a.ClassName == b.ClassName && a.MethodName == b.MethodName
+}
+
+func claimsSameName(a typegenEntry, b typegenEntry) bool {
+	return a.Kind == b.Kind && a.EventName == b.EventName
+}
+
+func duplicateEntryWarnings(entries []typegenEntry) []SourceValidationIssue {
+	var warnings []SourceValidationIssue
+
+	for i := 1; i < len(entries); i++ {
+		previous, current := entries[i-1], entries[i]
+		if !claimsSameName(previous, current) || isSameHandler(previous, current) {
+			continue
+		}
+
+		warnings = append(warnings, SourceValidationIssue{
+			File: current.SourceFile,
+			Line: current.SourceLine,
+			Message: fmt.Sprintf(
+				"%q is already handled by %s.%s (%s:%d); this handler is ignored by typegen",
+				current.EventName, previous.ClassName, previous.MethodName,
+				previous.SourceFile, previous.SourceLine,
+			),
+		})
+	}
+
+	return warnings
+}
+
+func quoteTSString(s string) string {
+	replacer := strings.NewReplacer("\\", "\\\\", "'", "\\'", "\n", "\\n", "\r", "")
+	return "'" + replacer.Replace(s) + "'"
+}
+
+func renderTypegenFile(entries []typegenEntry, views registeredViews, opts TypegenOptions) string {
+	var b strings.Builder
+	writeGeneratedHeader(&b, "Regenerated by `opencore dev` and `opencore build`.")
+
+	if len(entries) == 0 && views.empty() {
+		b.WriteString("export {};\n")
+		return b.String()
+	}
+
+	registerModule := registerModuleOf(opts)
+	aliases := newControllerAliases(entries)
+	byKind := groupByKind(entries)
+
+	writeTypegenPreamble(&b, entries, byKind, views, registerModule)
+	aliases.writeDeclarations(&b)
+	writeViewControllerAliases(&b, views.controllerImports)
+
+	var members []registerMember
+	for _, section := range sectionsPresentIn(byKind) {
+		writeSectionMap(&b, section, byKind[section.kind], aliases)
+		members = append(members, registerMember{section.registerAs, section.iface})
+	}
+	members = append(members, writeRegisteredViewMaps(&b, views)...)
+	writeRegisterAugmentation(&b, registerModule, opts, members)
+
+	return b.String()
+}
+
+// registerMember is one map a generated file files under its resource's `Register` key.
+type registerMember struct {
+	name  string
+	iface string
+}
+
+func writeRegisteredViewMaps(b *strings.Builder, views registeredViews) []registerMember {
+	var members []registerMember
+	if len(views.send) > 0 {
+		writeViewMap(b, "GenViewSend",
+			"/** Messages the client sends to a WebView (from its `send()` calls). */\n", views.send)
+		members = append(members, registerMember{"viewSend", "GenViewSend"})
+	}
+	if len(views.receive) > 0 {
+		writeViewMap(b, "GenViewReceive",
+			"/** Messages a WebView sends to the client (from `@Client.OnView` handlers). */\n", views.receive)
+		members = append(members, registerMember{"viewReceive", "GenViewReceive"})
+	}
+	return members
+}
+
+func registerModuleOf(opts TypegenOptions) string {
+	pkg := opts.FrameworkPackage
+	if pkg == "" {
+		pkg = defaultFrameworkPackage
+	}
+	return pkg + registerModuleSuffix
+}
+
+func writeGeneratedHeader(b *strings.Builder, subtitle string) {
+	b.WriteString("// Auto-generated by OpenCore CLI. Do not edit.\n")
+	fmt.Fprintf(b, "// %s\n", subtitle)
+	b.WriteString("/* eslint-disable */\n")
+	b.WriteString("// biome-ignore-all lint: generated file\n\n")
+}
+
+func groupByKind(entries []typegenEntry) map[typegenKind][]typegenEntry {
+	byKind := map[typegenKind][]typegenEntry{}
+	for _, e := range entries {
+		byKind[e.Kind] = append(byKind[e.Kind], e)
+	}
+	return byKind
+}
+
+func writeTypegenPreamble(
+	b *strings.Builder,
+	entries []typegenEntry,
+	byKind map[typegenKind][]typegenEntry,
+	views registeredViews,
+	registerModule string,
+) {
+	if len(byKind[kindServerNet]) > 0 || len(byKind[kindServerRPC]) > 0 {
+		fmt.Fprintf(b, "import type { DropFirst } from %s\n\n", quoteTSString(registerModule))
+	}
+
+	needsEntry := slices.ContainsFunc(entries, func(e typegenEntry) bool { return e.KeyType != "" }) ||
+		slices.ContainsFunc(views.all(), hasComputedViewKey)
+	needsPayload := slices.ContainsFunc(views.all(), usesPayloadHelper)
+
+	if needsEntry {
+		b.WriteString(entryHelperDecl)
+	}
+	if needsPayload {
+		b.WriteString(payloadHelperDecl)
+	}
+	if needsEntry || needsPayload {
+		b.WriteString("\n")
+	}
+}
+
+type controllerRef struct {
+	importPath string
+	className  string
+}
+
+type controllerAliases struct {
+	order []controllerRef
+	byRef map[controllerRef]string
+}
+
+func newControllerAliases(entries []typegenEntry) *controllerAliases {
+	aliases := &controllerAliases{byRef: map[controllerRef]string{}}
+
+	for _, e := range entries {
+		ref := controllerRef{e.ImportPath, e.ClassName}
+		if _, seen := aliases.byRef[ref]; !seen {
+			aliases.byRef[ref] = ""
+			aliases.order = append(aliases.order, ref)
+		}
+	}
+	slices.SortFunc(aliases.order, func(a, b controllerRef) int {
+		return cmp.Or(
+			strings.Compare(a.importPath, b.importPath),
+			strings.Compare(a.className, b.className),
+		)
+	})
+	for i, ref := range aliases.order {
+		aliases.byRef[ref] = fmt.Sprintf("T%d_%s", i, ref.className)
+	}
+
+	return aliases
+}
+
+func (a *controllerAliases) of(e typegenEntry) string {
+	return a.byRef[controllerRef{e.ImportPath, e.ClassName}]
+}
+
+func (a *controllerAliases) writeDeclarations(b *strings.Builder) {
+	for _, ref := range a.order {
+		fmt.Fprintf(b, "type %s = InstanceType<typeof import(%s).%s>\n",
+			a.byRef[ref], quoteTSString(ref.importPath), ref.className)
+	}
+	if len(a.order) > 0 {
+		b.WriteString("\n")
+	}
+}
+
+type typegenSection struct {
+	kind         typegenKind
+	iface        string
+	registerAs   string
+	dropPlayer   bool
+	isRPC        bool
+	isCommandMap bool
+}
+
+var typegenSections = []typegenSection{
+	{kind: kindServerNet, iface: "GenServerEvents", registerAs: "serverEvents", dropPlayer: true},
+	{kind: kindClientNet, iface: "GenClientEvents", registerAs: "clientEvents"},
+	{kind: kindServerRPC, iface: "GenServerRpc", registerAs: "serverRpc", dropPlayer: true, isRPC: true},
+	{kind: kindClientRPC, iface: "GenClientRpc", registerAs: "clientRpc", isRPC: true},
+	{kind: kindCommand, iface: "GenCommands", registerAs: "commands", isCommandMap: true},
+}
+
+func sectionsPresentIn(byKind map[typegenKind][]typegenEntry) []typegenSection {
+	var present []typegenSection
+	for _, section := range typegenSections {
+		if len(byKind[section.kind]) > 0 {
+			present = append(present, section)
+		}
+	}
+	return present
+}
+
+func writeSectionMap(
+	b *strings.Builder,
+	section typegenSection,
+	entries []typegenEntry,
+	aliases *controllerAliases,
+) {
+	literals, computed := partitionByKeyKind(entries)
+	fmt.Fprintf(b, "export type %s =", section.iface)
+
+	if len(literals) > 0 {
+		b.WriteString(" {\n")
+		for _, e := range literals {
+			fmt.Fprintf(b, "  %s: %s\n", quoteTSString(e.EventName), section.valueExpr(e, aliases))
+		}
+		b.WriteString("}")
+	}
+	for i, e := range computed {
+		if len(literals) > 0 || i > 0 {
+			b.WriteString("\n  &")
+		}
+		fmt.Fprintf(b, " __Entry<%s, %s> /* %s */",
+			e.KeyType, section.valueExpr(e, aliases), e.EventName)
+	}
+
+	b.WriteString("\n\n")
+}
+
+func partitionByKeyKind(entries []typegenEntry) (literals []typegenEntry, computed []typegenEntry) {
+	seen := map[string]bool{}
+	for _, e := range entries {
+		if seen[e.EventName] {
+			continue
+		}
+		seen[e.EventName] = true
+		if e.KeyType == "" {
+			literals = append(literals, e)
+		} else {
+			computed = append(computed, e)
+		}
+	}
+	return literals, computed
+}
+
+func (s typegenSection) valueExpr(e typegenEntry, aliases *controllerAliases) string {
+	switch {
+	case s.isCommandMap:
+		return commandValueExpr(e)
+	case s.isRPC:
+		return fmt.Sprintf("{ args: %s; result: %s }",
+			s.argsExpr(e, aliases), resultExpr(e, aliases))
+	default:
+		return s.argsExpr(e, aliases)
+	}
+}
+
+func (s typegenSection) argsExpr(e typegenEntry, aliases *controllerAliases) string {
+	params := fmt.Sprintf("Parameters<%s[%s]>", aliases.of(e), quoteTSString(e.MethodName))
+	if s.dropPlayer {
+		return fmt.Sprintf("DropFirst<%s>", params)
+	}
+	return params
+}
+
+func resultExpr(e typegenEntry, aliases *controllerAliases) string {
+	return fmt.Sprintf("Awaited<ReturnType<%s[%s]>>", aliases.of(e), quoteTSString(e.MethodName))
+}
+
+func commandValueExpr(e typegenEntry) string {
+	var fields []string
+	if e.Description != "" {
+		fields = append(fields, fmt.Sprintf("description: %s", quoteTSString(e.Description)))
+	}
+	if e.Usage != "" {
+		fields = append(fields, fmt.Sprintf("usage: %s", quoteTSString(e.Usage)))
+	}
+	if len(fields) == 0 {
+		return "Record<string, never>"
+	}
+	return "{ " + strings.Join(fields, "; ") + " }"
+}
+
+func writeRegisterAugmentation(
+	b *strings.Builder,
+	registerModule string,
+	opts TypegenOptions,
+	members []registerMember,
+) {
+	fmt.Fprintf(b, "declare module %s {\n", quoteTSString(registerModule))
+	b.WriteString("  interface Register {\n")
+	if opts.Strict {
+		b.WriteString("    strict: true\n")
+	}
+	fmt.Fprintf(b, "    %s: {\n", quoteTSString(opts.ResourceKey))
+	for _, member := range members {
+		fmt.Fprintf(b, "      %s: %s\n", member.name, member.iface)
+	}
+	b.WriteString("    }\n")
+	b.WriteString("  }\n")
+	b.WriteString("}\n")
+}
+
+func resourceRegisterKey(projectPath string, resourcePath string) string {
+	cleaned := filepath.ToSlash(filepath.Clean(resourcePath))
+
+	if rel, err := filepath.Rel(projectPath, resourcePath); err == nil {
+		rel = filepath.ToSlash(rel)
+		if !strings.HasPrefix(rel, "../") && rel != ".." {
+			cleaned = rel
+		}
+	}
+
+	cleaned = strings.TrimPrefix(cleaned, "./")
+	if cleaned == "" || cleaned == "." {
+		cleaned = "root"
+	}
+	return "resource:" + cleaned
+}
+
+func (rb *ResourceBuilder) generateTypes(resourcePath string, opts TypegenOptions) (*TypegenResult, error) {
+	resourcePath = filepath.Clean(resourcePath)
+	outDir := filepath.Join(resourcePath, ".opencore")
+	outFile := filepath.Join(outDir, typegenFileName)
+
+	entries, warnings, err := scanResourceForTypegen(resourcePath, outDir, rb.viewPathFor(resourcePath))
+	if err != nil {
+		return nil, err
+	}
+
+	// WebView messages are collected here as well as for the view's own file: this is the file
+	// that registers them with the framework, so it reports their diagnostics too.
+	views, err := rb.collectViewMessages(resourcePath, outDir, "WebView messages")
+	if err != nil {
+		return nil, err
+	}
+	warnings = append(warnings, views.warnings...)
+	sortValidationIssues(warnings)
+
+	if opts.ResourceKey == "" {
+		opts.ResourceKey = resourceRegisterKey(rb.projectPath, resourcePath)
+	}
+
+	changed, err := writeIfChanged(outFile, renderTypegenFile(entries, views.registered(), opts))
+	if err != nil {
+		return nil, err
+	}
+
+	return &TypegenResult{Entries: entries, Warnings: warnings, Changed: changed}, nil
+}
+
+func (rb *ResourceBuilder) RunTypegen(resourcePath string) (changed bool) {
+	if !rb.typegenEnabled {
+		rb.removeStaleTypes(resourcePath)
+		return false
+	}
+
+	resourceChanged, ok := rb.runResourceTypegen(resourcePath)
+	if !ok {
+		return false
+	}
+	viewChanged := rb.runViewTypegen(resourcePath)
+
+	return resourceChanged || viewChanged
+}
+
+func (rb *ResourceBuilder) removeStaleTypes(resourcePath string) {
+	if err := removeGeneratedTypes(resourcePath); err != nil {
+		fmt.Println(ui.Warning(fmt.Sprintf("Could not remove stale generated types: %v", err)))
+	}
+	if err := rb.removeGeneratedViewTypes(resourcePath); err != nil {
+		fmt.Println(ui.Warning(fmt.Sprintf("Could not remove stale generated view types: %v", err)))
+	}
+}
+
+func (rb *ResourceBuilder) runResourceTypegen(resourcePath string) (changed bool, ok bool) {
+	result, err := rb.generateTypes(resourcePath, rb.typegenOptions)
+	if err != nil {
+		fmt.Println(ui.Warning(fmt.Sprintf(
+			"Type generation skipped for %s: %v", filepath.Base(resourcePath), err)))
+		return false, false
+	}
+	rb.reportTypegenWarnings(resourcePath, result)
+	return result.Changed, true
+}
+
+func (rb *ResourceBuilder) runViewTypegen(resourcePath string) bool {
+	result, hasViews, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		fmt.Println(ui.Warning(fmt.Sprintf(
+			"View type generation skipped for %s: %v", filepath.Base(resourcePath), err)))
+		return false
+	}
+	if !hasViews || result == nil {
+		return false
+	}
+	// Its warnings are not reported: the resource's own file scans the same messages and
+	// already reported them.
+	return result.Changed
+}
+
+func (rb *ResourceBuilder) reportTypegenWarnings(resourcePath string, result *TypegenResult) {
+	if len(result.Warnings) == 0 {
+		return
+	}
+
+	rb.typegenWarnedMutex.Lock()
+	if rb.typegenWarned == nil {
+		rb.typegenWarned = make(map[string]bool)
+	}
+	alreadyWarned := rb.typegenWarned[resourcePath]
+	rb.typegenWarned[resourcePath] = true
+	rb.typegenWarnedMutex.Unlock()
+
+	if alreadyWarned {
+		return
+	}
+
+	name := filepath.Base(resourcePath)
+	fmt.Println(ui.Warning(fmt.Sprintf(
+		"typegen: %d handler(s) in %s could not be typed", len(result.Warnings), name,
+	)))
+	for _, issue := range result.Warnings {
+		fmt.Println(ui.Muted("  " + issue.String()))
+	}
+}
+
+func removeGeneratedTypes(resourcePath string) error {
+	outFile := filepath.Join(filepath.Clean(resourcePath), ".opencore", typegenFileName)
+	if err := os.Remove(outFile); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}
diff --git a/internal/builder/typegen_test.go b/internal/builder/typegen_test.go
new file mode 100644
index 0000000..e70198d
--- /dev/null
+++ b/internal/builder/typegen_test.go
@@ -0,0 +1,779 @@
+package builder
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func readGenFile(t *testing.T, resourcePath string) string {
+	t.Helper()
+	content, err := os.ReadFile(filepath.Join(resourcePath, ".opencore", typegenFileName))
+	if err != nil {
+		t.Fatalf("failed to read generated file: %v", err)
+	}
+	return string(content)
+}
+
+func TestGenerateTypes_ServerNetEventDropsPlayerParam(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+import { Server } from '@open-core/framework/server'
+
+@Server.Controller()
+export class BankController {
+  @Server.OnNet('bank:deposit', DepositSchema)
+  async deposit(player: Server.Player, amount: number) {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("expected no warnings, got %v", result.Warnings)
+	}
+	if !result.Changed {
+		t.Fatal("expected the first generation to report a change")
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	// The Player parameter must be stripped from the emitted payload tuple.
+	if !strings.Contains(content, "DropFirst<Parameters<") {
+		t.Fatalf("expected DropFirst wrapper for a server handler, got:\n%s", content)
+	}
+	if !strings.Contains(content, "'bank:deposit'") {
+		t.Fatalf("expected the event name in the output, got:\n%s", content)
+	}
+	if !strings.Contains(content, "'deposit'") {
+		t.Fatalf("expected the method name in the output, got:\n%s", content)
+	}
+	if !strings.Contains(content, "serverEvents: GenServerEvents") {
+		t.Fatalf("expected the Register augmentation, got:\n%s", content)
+	}
+	// The import must be relative to .opencore/, not to the resource root.
+	if !strings.Contains(content, "'../src/server/bank.controller'") {
+		t.Fatalf("expected an import path relative to .opencore, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_AugmentsTheDeclaringModuleNotThePackageRoot(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  @Server.OnNet('bank:deposit')
+  deposit(player: Server.Player, amount: number) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	if !strings.Contains(content, "declare module '@open-core/framework/register'") {
+		t.Fatalf("expected the augmentation to target the declaring module, got:\n%s", content)
+	}
+	if strings.Contains(content, "declare module '@open-core/framework'") {
+		t.Fatalf("augmenting the package root silently disables all narrowing, got:\n%s", content)
+	}
+	// The helper import must come from the same module for the augmentation to resolve.
+	if !strings.Contains(content, "import type { DropFirst } from '@open-core/framework/register'") {
+		t.Fatalf("expected DropFirst to be imported from the register module, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_FilesMapsUnderAPerResourceKey(t *testing.T) {
+	projectRoot := t.TempDir()
+	rb := NewResourceBuilder(projectRoot)
+
+	resourcePath := filepath.Join(projectRoot, "resources", "bank")
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  @Server.OnNet('bank:deposit')
+  deposit(player: Server.Player, amount: number) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	if !strings.Contains(content, "'resource:resources/bank': {") {
+		t.Fatalf("expected the maps to be filed under a per-resource key, got:\n%s", content)
+	}
+	if strings.Contains(content, "\n    serverEvents:") {
+		t.Fatalf("a map declared directly on Register collides with every other resource, got:\n%s", content)
+	}
+	if !strings.Contains(content, "      serverEvents: GenServerEvents") {
+		t.Fatalf("expected serverEvents inside the resource entry, got:\n%s", content)
+	}
+}
+
+func TestResourceRegisterKeyIsProjectRelative(t *testing.T) {
+	if got := resourceRegisterKey("/proj", "/proj/resources/bank"); got != "resource:resources/bank" {
+		t.Fatalf("expected a project-relative key, got %q", got)
+	}
+	// Two resources sharing a basename across groups must not collide.
+	a := resourceRegisterKey("/proj", "/proj/resources/chat")
+	b := resourceRegisterKey("/proj", "/proj/standalones/chat")
+	if a == b {
+		t.Fatalf("same-named resources in different groups collide: %q", a)
+	}
+	// A path outside the project falls back to something usable rather than "../..".
+	if got := resourceRegisterKey("/proj", "/elsewhere/bank"); strings.Contains(got, "..") {
+		t.Fatalf("expected no parent traversal in the key, got %q", got)
+	}
+}
+
+func TestGenerateTypes_AttributesHandlersToTheirOwnClass(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/pair.controller.ts", `
+@Server.Controller()
+export class FirstController {
+  @Server.OnNet('first:ping')
+  onPing(player: Server.Player, a: number) {}
+}
+
+@Server.Controller()
+export class SecondController {
+  @Server.OnNet('second:pong')
+  onPong(player: Server.Player, b: string) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	if !strings.Contains(content, "'first:ping': DropFirst<Parameters<T0_FirstController['onPing']>>") {
+		t.Fatalf("expected the first handler on its own class, got:\n%s", content)
+	}
+	if !strings.Contains(content, "'second:pong': DropFirst<Parameters<T1_SecondController['onPong']>>") {
+		t.Fatalf("expected the second handler on SecondController, got:\n%s", content)
+	}
+	if strings.Contains(content, "T0_FirstController['onPong']") {
+		t.Fatalf("a handler was attributed to the wrong class, got:\n%s", content)
+	}
+}
+
+// A decorator left behind in a comment used to be scanned as real and bound to whatever method
+// followed it, which both invents an event and retypes a real one against the wrong handler.
+func TestGenerateTypes_IgnoresCommentedDecorators(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  // @Server.OnNet('bank:removed')
+  /* @Server.OnNet('bank:alsoRemoved') */
+  @Server.OnNet('bank:deposit')
+  deposit(player: Server.Player, amount: number) {}
+
+  /**
+   * @Server.Command('docs-example')
+   */
+  @Server.OnNet('bank:withdraw')
+  withdraw(player: Server.Player, amount: number) {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	for _, ghost := range []string{"bank:removed", "bank:alsoRemoved", "docs-example"} {
+		if strings.Contains(content, ghost) {
+			t.Fatalf("a commented-out decorator was scanned (%s), got:\n%s", ghost, content)
+		}
+	}
+	if !strings.Contains(content, "'bank:deposit'") || !strings.Contains(content, "'bank:withdraw'") {
+		t.Fatalf("expected both real handlers, got:\n%s", content)
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("expected no warnings, got %v", result.Warnings)
+	}
+}
+
+func TestBlankCommentsPreservesOffsetsAndStrings(t *testing.T) {
+	source := "const a = 'http://not-a-comment'\n// gone\nconst b = 1 /* gone */\n"
+	blanked := blankComments(source)
+
+	if len(blanked) != len(source) {
+		t.Fatalf("length changed: %d vs %d", len(blanked), len(source))
+	}
+	if strings.Count(blanked, "\n") != strings.Count(source, "\n") {
+		t.Fatal("newlines must survive so line numbers do not shift")
+	}
+	if !strings.Contains(blanked, "'http://not-a-comment'") {
+		t.Fatalf("a `//` inside a string is not a comment, got:\n%q", blanked)
+	}
+	if strings.Contains(blanked, "gone") {
+		t.Fatalf("comment contents survived, got:\n%q", blanked)
+	}
+	if !strings.Contains(blanked, "const b = 1") {
+		t.Fatalf("code before a block comment was damaged, got:\n%q", blanked)
+	}
+}
+
+func TestGenerateTypesResolvesImportedAliasDefaultAndNamespace(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+	writeTestFile(t, resourcePath, "src/events.ts", `
+export const Named = { Event: 'named' } as const
+const DefaultEvents = { Event: 'default' } as const
+export default DefaultEvents
+`)
+	writeTestFile(t, resourcePath, "src/server/controller.ts", `
+import { Named as Alias } from '../events'
+import Defaults from '../events'
+import * as Events from '../events'
+export class Controller {
+  @Server.OnNet(Alias.Event) named(player: unknown) {}
+  @Server.OnNet(Defaults.Event) defaults(player: unknown) {}
+  @Server.OnNet(Events.Named.Event) namespace(player: unknown) {}
+}
+`)
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	content := readGenFile(t, resourcePath)
+	for _, expected := range []string{
+		"typeof import('../src/events').Named['Event']",
+		"typeof import('../src/events').default['Event']",
+		"/* Events.Named.Event */",
+	} {
+		if !strings.Contains(content, expected) {
+			t.Fatalf("missing %q in generated types:\n%s", expected, content)
+		}
+	}
+}
+
+func TestGenerateTypes_DuplicateEventNameIsReportedAndStable(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/a.controller.ts", `
+@Server.Controller()
+export class AController {
+  @Server.OnNet('shared:name')
+  handleA(player: Server.Player, a: number) {}
+}
+`)
+	writeTestFile(t, resourcePath, "src/server/b.controller.ts", `
+@Server.Controller()
+export class BController {
+  @Server.OnNet('shared:name')
+  handleB(player: Server.Player, b: string) {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	if len(result.Warnings) != 1 {
+		t.Fatalf("expected the clash to be reported once, got %v", result.Warnings)
+	}
+	if !strings.Contains(result.Warnings[0].Message, "shared:name") {
+		t.Fatalf("the warning must name the event, got %q", result.Warnings[0].Message)
+	}
+
+	first := readGenFile(t, resourcePath)
+
+	// Regenerating the same sources must produce the same winner, byte for byte.
+	for i := 0; i < 5; i++ {
+		again, regenErr := rb.generateTypes(resourcePath, TypegenOptions{})
+		if regenErr != nil {
+			t.Fatalf("regeneration failed: %v", regenErr)
+		}
+		if again.Changed {
+			t.Fatal("regeneration rewrote the file without a source change")
+		}
+	}
+	if readGenFile(t, resourcePath) != first {
+		t.Fatal("the generated file is not stable across runs")
+	}
+}
+
+func TestGenerateTypes_ClientNetEventKeepsAllParams(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/client/hud.controller.ts", `
+import { Client } from '@open-core/framework/client'
+
+@Client.Controller()
+export class HudController {
+  @Client.OnNet('hud:setCash')
+  setCash(amount: number) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	if strings.Contains(content, "DropFirst") {
+		t.Fatalf("client handlers must not drop a parameter, got:\n%s", content)
+	}
+	if !strings.Contains(content, "clientEvents: GenClientEvents") {
+		t.Fatalf("expected clientEvents registration, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_RpcIncludesArgsAndResult(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  @Server.OnRPC('bank:getBalance')
+  async getBalance(player: Server.Player, accountId: string): Promise<number> {
+    return 0
+  }
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	if !strings.Contains(content, "args:") || !strings.Contains(content, "result:") {
+		t.Fatalf("expected an RPC entry with args and result, got:\n%s", content)
+	}
+	if !strings.Contains(content, "Awaited<ReturnType<") {
+		t.Fatalf("expected the result to unwrap the Promise, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_CommandConfigObjectForm(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  @Server.Command({ command: 'withdraw', description: 'Take money out', usage: '/withdraw <n>' })
+  withdraw(player: Server.Player) {}
+
+  @Server.Command('help')
+  help(player: Server.Player) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	for _, want := range []string{"'withdraw'", "'help'", "Take money out", "/withdraw <n>", "commands: GenCommands"} {
+		if !strings.Contains(content, want) {
+			t.Fatalf("expected %q in the output, got:\n%s", want, content)
+		}
+	}
+}
+
+func TestGenerateTypes_MultilineDecorator(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/multi.controller.ts", `
+@Server.Controller()
+export class MultiController {
+  @Server.OnNet(
+    'multi:line',
+    SomeSchema,
+  )
+  handle(player: Server.Player, value: number) {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("expected no warnings for a multiline decorator, got %v", result.Warnings)
+	}
+
+	content := readGenFile(t, resourcePath)
+	if !strings.Contains(content, "'multi:line'") || !strings.Contains(content, "'handle'") {
+		t.Fatalf("expected the multiline decorator to be extracted, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_NonLiteralEventNameIsSkippedWithWarning(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/dyn.controller.ts", `
+@Server.Controller()
+export class DynController {
+  @Server.OnNet(EVENTS.SOMETHING)
+  handle(player: Server.Player) {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	if len(result.Entries) != 0 {
+		t.Fatalf("expected the non-literal entry to be skipped, got %v", result.Entries)
+	}
+	if len(result.Warnings) != 1 {
+		t.Fatalf("expected exactly 1 warning, got %v", result.Warnings)
+	}
+	if !strings.Contains(result.Warnings[0].Message, "could not resolve the event name") {
+		t.Fatalf("unexpected warning message: %s", result.Warnings[0].Message)
+	}
+
+	// A skipped entry must never fail the build; the file is still written.
+	if content := readGenFile(t, resourcePath); !strings.Contains(content, "export {};") {
+		t.Fatalf("expected an empty generated file, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_ResolvesImportedConstReference(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/shared/character-events.ts", `
+export const CharacterNetEvents = {
+  UI_OPEN: 'character:ui:open',
+  UI_CLOSE: 'character:ui:close',
+} as const
+`)
+	writeTestFile(t, resourcePath, "src/client/controllers/character-ui.controller.ts", `
+import { Client } from '@open-core/framework/client'
+import { CharacterNetEvents } from '../../shared/character-events'
+
+@Client.Controller()
+export class CharacterUiController {
+  @Client.OnNet(CharacterNetEvents.UI_OPEN)
+  async onOpen(state: CharacterUiState): Promise<void> {}
+
+  @Client.OnNet(CharacterNetEvents.UI_CLOSE)
+  onClose(): void {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("expected constant references to resolve, got warnings: %v", result.Warnings)
+	}
+	if len(result.Entries) != 2 {
+		t.Fatalf("expected 2 entries, got %d", len(result.Entries))
+	}
+
+	content := readGenFile(t, resourcePath)
+
+	// The import path must be rewritten relative to .opencore/, not left as written in the
+	// controller (which was relative to the controller's own directory).
+	want := "typeof import('../src/shared/character-events').CharacterNetEvents['UI_OPEN']"
+	if !strings.Contains(content, want) {
+		t.Fatalf("expected %q in the output, got:\n%s", want, content)
+	}
+	if !strings.Contains(content, "__Entry<") {
+		t.Fatalf("expected computed keys to use the __Entry helper, got:\n%s", content)
+	}
+	if !strings.Contains(content, "type __Entry<K extends PropertyKey, V>") {
+		t.Fatalf("expected the __Entry helper to be declared, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_ResolvesBarePackageConstReference(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/client/ui.controller.ts", `
+import { Client } from '@open-core/framework/client'
+import { SystemUiNetEvents } from '@glint/system-ui'
+
+@Client.Controller()
+export class UiController {
+  @Client.OnNet(SystemUiNetEvents.NOTIFICATION_SHOW)
+  onShow(options: NotificationOptions): void {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+	// Bare specifiers resolve identically from any directory and must be left untouched.
+	want := "typeof import('@glint/system-ui').SystemUiNetEvents['NOTIFICATION_SHOW']"
+	if !strings.Contains(content, want) {
+		t.Fatalf("expected %q in the output, got:\n%s", want, content)
+	}
+}
+
+func TestGenerateTypes_InlinesFileLocalStringConst(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/client/local.controller.ts", `
+import { Client } from '@open-core/framework/client'
+
+const CHAT_LOCK_EVENT = 'glint:chat:setBlocked'
+
+@Client.Controller()
+export class LocalController {
+  @Client.OnNet(CHAT_LOCK_EVENT)
+  onLock(blocked: boolean): void {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("expected the local const to resolve, got warnings: %v", result.Warnings)
+	}
+
+	content := readGenFile(t, resourcePath)
+	// A non-exported local constant cannot be imported, so its value is inlined instead.
+	if !strings.Contains(content, "'glint:chat:setBlocked'") {
+		t.Fatalf("expected the local const to be inlined, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_ResolvesAliasedImport(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/shared/events.ts", `
+export const Events = { PING: 'x:ping' } as const
+`)
+	writeTestFile(t, resourcePath, "src/client/alias.controller.ts", `
+import { Events as NetEvents } from '../shared/events'
+
+@Client.Controller()
+export class AliasController {
+  @Client.OnNet(NetEvents.PING)
+  onPing(): void {}
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("expected the aliased import to resolve, got warnings: %v", result.Warnings)
+	}
+
+	content := readGenFile(t, resourcePath)
+	// Type queries address exports of the imported module, not local aliases.
+	if !strings.Contains(content, ".Events['PING']") || strings.Contains(content, ".NetEvents['PING']") {
+		t.Fatalf("expected the original exported binding in the reference, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_NoDecoratorsProducesEmptyModule(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/plain.ts", `
+export class PlainService {
+  doThing() {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+	if !strings.Contains(content, "export {};") {
+		t.Fatalf("expected an empty module, got:\n%s", content)
+	}
+	if strings.Contains(content, "declare module") {
+		t.Fatalf("an empty result must not augment Register, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_IsIdempotent(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  @Server.OnNet('bank:deposit')
+  deposit(player: Server.Player, amount: number) {}
+}
+`)
+
+	first, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("first generateTypes returned error: %v", err)
+	}
+	if !first.Changed {
+		t.Fatal("expected the first run to write the file")
+	}
+
+	firstContent := readGenFile(t, resourcePath)
+
+	second, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("second generateTypes returned error: %v", err)
+	}
+	// Re-writing an identical file would feed the dev watcher a spurious change event.
+	if second.Changed {
+		t.Fatal("expected the second run to detect no change")
+	}
+	if readGenFile(t, resourcePath) != firstContent {
+		t.Fatal("expected identical output across runs")
+	}
+}
+
+func TestGenerateTypes_StrictModeMarker(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  @Server.OnNet('bank:deposit')
+  deposit(player: Server.Player) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{Strict: true}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	if content := readGenFile(t, resourcePath); !strings.Contains(content, "strict: true") {
+		t.Fatalf("expected the strict marker, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_SkipsViewsAndNodeModules(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/real.controller.ts", `
+@Server.Controller()
+export class RealController {
+  @Server.OnNet('real:event')
+  handle(player: Server.Player) {}
+}
+`)
+	writeTestFile(t, resourcePath, "ui/fake.controller.ts", `
+@Server.Controller()
+export class UiController {
+  @Server.OnNet('ui:should-not-appear')
+  handle(player: Server.Player) {}
+}
+`)
+	writeTestFile(t, resourcePath, "node_modules/pkg/dep.controller.ts", `
+@Server.Controller()
+export class DepController {
+  @Server.OnNet('dep:should-not-appear')
+  handle(player: Server.Player) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+	if !strings.Contains(content, "'real:event'") {
+		t.Fatalf("expected the real event, got:\n%s", content)
+	}
+	if strings.Contains(content, "should-not-appear") {
+		t.Fatalf("ui/ and node_modules/ must be skipped, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_DuplicateClassNamesGetDistinctAliases(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/a/main.controller.ts", `
+@Server.Controller()
+export class MainController {
+  @Server.OnNet('a:event')
+  handle(player: Server.Player) {}
+}
+`)
+	writeTestFile(t, resourcePath, "src/server/b/main.controller.ts", `
+@Server.Controller()
+export class MainController {
+  @Server.OnNet('b:event')
+  handle(player: Server.Player) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+	if !strings.Contains(content, "T0_MainController") || !strings.Contains(content, "T1_MainController") {
+		t.Fatalf("expected distinct aliases for same-named classes, got:\n%s", content)
+	}
+}
+
+func TestRemoveGeneratedTypes(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/server/bank.controller.ts", `
+@Server.Controller()
+export class BankController {
+  @Server.OnNet('bank:deposit')
+  deposit(player: Server.Player) {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+	if err := removeGeneratedTypes(resourcePath); err != nil {
+		t.Fatalf("removeGeneratedTypes returned error: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(resourcePath, ".opencore", typegenFileName)); !os.IsNotExist(err) {
+		t.Fatal("expected the generated file to be removed")
+	}
+	// Removing a file that is already gone must be a no-op.
+	if err := removeGeneratedTypes(resourcePath); err != nil {
+		t.Fatalf("expected removing a missing file to be a no-op, got: %v", err)
+	}
+}
diff --git a/internal/builder/typegen_views.go b/internal/builder/typegen_views.go
new file mode 100644
index 0000000..63a95f9
--- /dev/null
+++ b/internal/builder/typegen_views.go
@@ -0,0 +1,630 @@
+package builder
+
+import (
+	"cmp"
+	"fmt"
+	"maps"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+)
+
+// identifierPattern matches a bare JavaScript identifier, used to spot alias references inside a rendered type expression.
+var identifierPattern = regexp.MustCompile(`[A-Za-z_$][A-Za-z0-9_$]*`)
+
+const (
+	viewTypegenFileName          = "opencore.gen.ts"
+	viewPayloadUnresolvedPrefix  = "could not derive the payload type of"
+	viewSendNameUnresolvedPrefix = "could not resolve a WebView send() event name"
+)
+
+// viewEntry is one message discovered on the client side
+type viewEntry struct {
+	EventName   string
+	KeyType     string
+	PayloadType string
+}
+
+// methodInfo describes one method declaration and where it sits in the file
+type methodInfo struct {
+	name       string
+	offset     int
+	paramNames []string
+}
+
+func isClientSideFile(path string, text string) bool {
+	segments := strings.Split(filepath.ToSlash(path), "/")
+	if slices.Contains(segments, "server") {
+		return false
+	}
+	return slices.Contains(segments, "client") || strings.Contains(text, "@Client.")
+}
+
+// splitTopLevelArgs splits a decorator/call argument list on commas that are not nested inside
+// brackets or string literals.
+func splitTopLevelArgs(args string) []string {
+	var parts []string
+	depth := 0
+	var quote byte
+	inQuote := false
+	start := 0
+
+	for i := 0; i < len(args); i++ {
+		c := args[i]
+		if inQuote {
+			if c == '\\' {
+				i++
+				continue
+			}
+			if c == quote {
+				inQuote = false
+			}
+			continue
+		}
+		switch c {
+		case '\'', '"', '`':
+			inQuote = true
+			quote = c
+		case '(', '[', '{':
+			depth++
+		case ')', ']', '}':
+			depth--
+		case ',':
+			if depth == 0 {
+				parts = append(parts, args[start:i])
+				start = i + 1
+			}
+		}
+	}
+	parts = append(parts, args[start:])
+	return parts
+}
+
+func parseParamNames(params string) []string {
+	var names []string
+	for _, part := range splitTopLevelArgs(params) {
+		if name := parameterIdentifier(part); name != "" {
+			names = append(names, name)
+		}
+	}
+	return names
+}
+
+var parameterModifiers = []string{"public ", "private ", "protected ", "readonly "}
+
+func parameterIdentifier(declaration string) string {
+	name := strings.TrimSpace(declaration)
+	for _, modifier := range parameterModifiers {
+		name = strings.TrimPrefix(name, modifier)
+	}
+	name = strings.TrimPrefix(name, "...")
+	if idx := strings.IndexAny(name, ":=?"); idx >= 0 {
+		name = name[:idx]
+	}
+	return strings.TrimSpace(name)
+}
+
+func collectMethods(text string) []methodInfo {
+	var methods []methodInfo
+
+	offset := 0
+	for _, line := range strings.SplitAfter(text, "\n") {
+		if method, ok := methodDeclaredAt(text, line, offset); ok {
+			methods = append(methods, method)
+		}
+		offset += len(line)
+	}
+
+	return methods
+}
+
+func methodDeclaredAt(text string, line string, offset int) (methodInfo, bool) {
+	m := methodDeclPattern.FindStringSubmatch(line)
+	if m == nil || nonMethodNames[m[1]] {
+		return methodInfo{}, false
+	}
+
+	openRel := strings.Index(line, "(")
+	if openRel < 0 {
+		return methodInfo{}, false
+	}
+	params, _, ok := extractDecoratorArgs(text, offset+openRel)
+	if !ok {
+		return methodInfo{}, false
+	}
+
+	return methodInfo{name: m[1], offset: offset, paramNames: parseParamNames(params)}, true
+}
+
+func enclosingMethod(methods []methodInfo, offset int) *methodInfo {
+	var found *methodInfo
+	for i := range methods {
+		if methods[i].offset <= offset {
+			found = &methods[i]
+			continue
+		}
+		break
+	}
+	return found
+}
+
+func scanFileForViewTypes(
+	text string,
+	relPath string,
+	classes []classInfo,
+	aliasFor func(className string) string,
+	sourceFile string,
+	selfImportPath string,
+	baseDir string,
+) (uiSends []viewEntry, uiReceives []viewEntry, warnings []SourceValidationIssue) {
+	scan := &viewScan{
+		fileScan: fileScan{
+			text:       blankComments(text),
+			relPath:    relPath,
+			importPath: selfImportPath,
+			sourceFile: sourceFile,
+			baseDir:    baseDir,
+			classes:    classes,
+		},
+		aliasFor: aliasFor,
+	}
+	scan.syms = parseFileSymbols(scan.text)
+	scan.methods = collectMethods(scan.text)
+
+	uiSends, sendWarnings := scan.messagesTheViewMaySend()
+	uiReceives, receiveWarnings := scan.messagesTheViewReceives()
+
+	return uiSends, uiReceives, append(sendWarnings, receiveWarnings...)
+}
+
+type viewScan struct {
+	fileScan
+	methods  []methodInfo
+	aliasFor func(className string) string
+}
+
+func (s *viewScan) messagesTheViewMaySend() ([]viewEntry, []SourceValidationIssue) {
+	var entries []viewEntry
+	var warnings []SourceValidationIssue
+
+	for _, loc := range clientOnViewHead.FindAllStringIndex(s.text, -1) {
+		args, endIdx, balanced := extractDecoratorArgs(s.text, loc[1]-1)
+		if !balanced {
+			continue
+		}
+
+		eventName, keyType, resolved := s.resolveName(args)
+		if !resolved {
+			warnings = append(warnings, *s.issue(loc[0],
+				"could not resolve the @Client.OnView event name; skipped by typegen"))
+			continue
+		}
+
+		methodName, found := methodNameAfter(s.text, endIdx+1)
+		if !found {
+			continue
+		}
+
+		entries = append(entries, viewEntry{
+			EventName:   eventName,
+			KeyType:     keyType,
+			PayloadType: s.handlerPayloadExpr(loc[0], methodName),
+		})
+	}
+
+	return entries, warnings
+}
+
+func (s *viewScan) messagesTheViewReceives() ([]viewEntry, []SourceValidationIssue) {
+	var entries []viewEntry
+	var warnings []SourceValidationIssue
+
+	for _, loc := range webViewSendPattern.FindAllStringIndex(s.text, -1) {
+		args, _, balanced := extractDecoratorArgs(s.text, loc[1]-1)
+		if !balanced {
+			continue
+		}
+
+		parts := splitTopLevelArgs(args)
+		if len(parts) == 0 || strings.TrimSpace(parts[0]) == "" {
+			continue
+		}
+
+		eventName, keyType, resolved := s.resolveName(parts[0])
+		if !resolved {
+			warnings = append(warnings, *s.issue(loc[0], viewSendNameUnresolvedPrefix+"; skipped by typegen"))
+			continue
+		}
+
+		payload := s.sendPayloadExpr(parts, loc[0])
+		if payload == "" {
+			payload = "unknown"
+			warnings = append(warnings, *s.issuef(loc[0],
+				"%s %q; the WebView receives `unknown` (pass a parameter of the enclosing method, e.g. `send(name, data)` inside `method(data: Payload)`)",
+				viewPayloadUnresolvedPrefix, eventName))
+		}
+
+		entries = append(entries, viewEntry{EventName: eventName, KeyType: keyType, PayloadType: payload})
+	}
+
+	return entries, warnings
+}
+
+func (s *viewScan) resolveName(arg string) (string, string, bool) {
+	return resolveNameArgument(arg, s.syms, s.sourceFile, s.importPath, s.baseDir)
+}
+
+func (s *viewScan) handlerPayloadExpr(offset int, methodName string) string {
+	return fmt.Sprintf("__Payload<Parameters<%s[%s]>>",
+		s.aliasAt(offset), quoteTSString(methodName))
+}
+
+func (s *viewScan) sendPayloadExpr(parts []string, offset int) string {
+	if len(parts) < 2 {
+		return "undefined"
+	}
+	arg := strings.TrimSpace(parts[1])
+	if arg == "undefined" {
+		return "undefined"
+	}
+	return forwardedPayloadType(arg, s.methods, offset, s.aliasAt(offset))
+}
+
+func (s *viewScan) aliasAt(offset int) string {
+	return s.aliasFor(enclosingClass(s.classes, offset))
+}
+
+func forwardedPayloadType(arg string, methods []methodInfo, offset int, classAlias string) string {
+	method := enclosingMethod(methods, offset)
+	if method == nil {
+		return ""
+	}
+	for i, param := range method.paramNames {
+		if param == arg {
+			return fmt.Sprintf("Parameters<%s[%s]>[%d]", classAlias, quoteTSString(method.name), i)
+		}
+	}
+	return ""
+}
+
+func resolveNameArgument(
+	arg string,
+	syms *fileSymbols,
+	sourceFile string,
+	selfImportPath string,
+	baseDir string,
+) (eventName string, keyType string, ok bool) {
+	if literal, found := firstStringLiteral(arg); found {
+		return literal, "", true
+	}
+	resolvedKey, display, resolved := resolveEventNameExpression(
+		arg, syms, sourceFile, selfImportPath, baseDir,
+	)
+	if !resolved {
+		return display, "", false
+	}
+	return display, resolvedKey, true
+}
+
+const entryHelperDecl = "/** Single-key map, used when an event name comes from a shared const object. */\n" +
+	"type __Entry<K extends PropertyKey, V> = { [P in K]: V }\n"
+
+const payloadHelperDecl = "/** First parameter of a handler, or `undefined` when it takes none. */\n" +
+	"type __Payload<P extends unknown[]> = P extends [infer First, ...unknown[]] ? First : undefined\n"
+
+func writeViewHelpers(b *strings.Builder, entries []viewEntry) {
+	if slices.ContainsFunc(entries, hasComputedViewKey) {
+		b.WriteString(entryHelperDecl)
+	}
+	if slices.ContainsFunc(entries, usesPayloadHelper) {
+		b.WriteString(payloadHelperDecl)
+	}
+	b.WriteString("\n")
+}
+
+func hasComputedViewKey(e viewEntry) bool {
+	return e.KeyType != ""
+}
+
+func usesPayloadHelper(e viewEntry) bool {
+	return strings.Contains(e.PayloadType, "__Payload<")
+}
+
+func writeViewControllerAliases(b *strings.Builder, controllerImports map[string]string) {
+	aliases := slices.Sorted(maps.Keys(controllerImports))
+	for _, alias := range aliases {
+		_, className, _ := strings.Cut(alias, "_")
+		fmt.Fprintf(b, "type %s = InstanceType<typeof import(%s).%s>\n",
+			alias, quoteTSString(controllerImports[alias]), className)
+	}
+	if len(aliases) > 0 {
+		b.WriteString("\n")
+	}
+}
+
+func renderViewTypesFile(
+	uiSends []viewEntry,
+	uiReceives []viewEntry,
+	controllerImports map[string]string,
+) string {
+	var b strings.Builder
+	writeGeneratedHeader(&b, "Types for this WebView's messages, derived from the client script.")
+
+	if len(uiSends) == 0 && len(uiReceives) == 0 {
+		b.WriteString("export type UiCanSend = Record<string, never>\n")
+		b.WriteString("export type UiReceives = Record<string, never>\n")
+		return b.String()
+	}
+
+	writeViewHelpers(&b, slices.Concat(uiSends, uiReceives))
+	writeViewControllerAliases(&b, controllerImports)
+
+	writeViewMap(&b, "UiCanSend",
+		"/** Messages this WebView may send to the client (from `@Client.OnView` handlers). */\n",
+		uiSends)
+	writeViewMap(&b, "UiReceives",
+		"/** Messages the client sends to this WebView (from its `send()` calls). */\n",
+		uiReceives)
+
+	return b.String()
+}
+
+func writeViewMap(b *strings.Builder, name string, doc string, entries []viewEntry) {
+	literals, computed := partitionViewEntries(entries)
+
+	b.WriteString(doc)
+	fmt.Fprintf(b, "export type %s =", name)
+
+	if len(literals) == 0 && len(computed) == 0 {
+		b.WriteString(" Record<string, never>\n\n")
+		return
+	}
+
+	if len(literals) > 0 {
+		b.WriteString(" {\n")
+		for _, e := range literals {
+			fmt.Fprintf(b, "  %s: %s\n", quoteTSString(e.EventName), e.PayloadType)
+		}
+		b.WriteString("}")
+	}
+	for i, e := range computed {
+		if len(literals) > 0 || i > 0 {
+			b.WriteString("\n  &")
+		}
+		fmt.Fprintf(b, " __Entry<%s, %s> /* %s */", e.KeyType, e.PayloadType, e.EventName)
+	}
+	b.WriteString("\n\n")
+}
+
+func partitionViewEntries(entries []viewEntry) (literals []viewEntry, computed []viewEntry) {
+	seen := map[string]bool{}
+	for _, e := range entries {
+		if seen[e.EventName] {
+			continue
+		}
+		seen[e.EventName] = true
+		if e.KeyType == "" {
+			literals = append(literals, e)
+		} else {
+			computed = append(computed, e)
+		}
+	}
+	return literals, computed
+}
+
+func (rb *ResourceBuilder) generateViewTypes(resourcePath string) (*TypegenResult, bool, error) {
+	resourcePath = filepath.Clean(resourcePath)
+
+	viewPath := rb.viewPathFor(resourcePath)
+	if viewPath == "" {
+		return nil, false, nil
+	}
+
+	outDir := filepath.Join(viewPath, ".opencore")
+	collector, err := rb.collectViewMessages(resourcePath, outDir, filepath.Base(viewPath))
+	if err != nil {
+		return nil, true, err
+	}
+
+	changed, err := writeIfChanged(filepath.Join(outDir, viewTypegenFileName), collector.render())
+	if err != nil {
+		return nil, true, err
+	}
+
+	return &TypegenResult{Warnings: collector.warnings, Changed: changed}, true, nil
+}
+
+// collectViewMessages scans a resource's client code for WebView messages, rendering every type
+// expression relative to outDir. label names the view in diagnostics.
+func (rb *ResourceBuilder) collectViewMessages(resourcePath string, outDir string, label string) (*viewCollector, error) {
+	collector := newViewCollector(resourcePath, outDir)
+	if err := walkSourceFiles(resourcePath, rb.viewPathFor(resourcePath), collector.collectFile); err != nil {
+		return nil, err
+	}
+	collector.finalise(label)
+	return collector, nil
+}
+
+type viewCollector struct {
+	resourcePath string
+	outDir       string
+
+	uiSends    []viewEntry
+	uiReceives []viewEntry
+	warnings   []SourceValidationIssue
+
+	controllerImports map[string]string
+	aliasByClass      map[string]string
+	aliasIndex        int
+}
+
+func newViewCollector(resourcePath string, outDir string) *viewCollector {
+	return &viewCollector{
+		resourcePath:      resourcePath,
+		outDir:            outDir,
+		controllerImports: map[string]string{},
+		aliasByClass:      map[string]string{},
+	}
+}
+
+func (c *viewCollector) collectFile(path string, text string) error {
+	if !isViewMessageSource(path, text) {
+		return nil
+	}
+
+	classes := collectClasses(text)
+	if len(classes) == 0 {
+		return nil
+	}
+
+	importPath, err := moduleImportPath(c.outDir, path)
+	if err != nil {
+		return err
+	}
+
+	sends, receives, warnings := scanFileForViewTypes(
+		text, relativeSourcePath(c.resourcePath, path), classes,
+		c.aliasFactory(importPath), path, importPath, c.outDir,
+	)
+
+	c.uiSends = append(c.uiSends, sends...)
+	c.uiReceives = append(c.uiReceives, receives...)
+	c.warnings = append(c.warnings, warnings...)
+	return nil
+}
+
+func (c *viewCollector) aliasFactory(importPath string) func(className string) string {
+	return func(className string) string {
+		key := importPath + "#" + className
+		if existing, seen := c.aliasByClass[key]; seen {
+			return existing
+		}
+		alias := fmt.Sprintf("V%d_%s", c.aliasIndex, className)
+		c.aliasIndex++
+		c.aliasByClass[key] = alias
+		c.controllerImports[alias] = importPath
+		return alias
+	}
+}
+
+func (c *viewCollector) finalise(viewName string) {
+	sortViewEntries(c.uiSends)
+	sortViewEntries(c.uiReceives)
+	c.warnings = append(c.warnings, duplicateViewWarnings(viewName, c.uiReceives)...)
+	sortValidationIssues(c.warnings)
+}
+
+func (c *viewCollector) render() string {
+	return renderViewTypesFile(
+		c.uiSends, c.uiReceives,
+		pruneUnusedControllerImports(c.controllerImports, c.uiSends, c.uiReceives),
+	)
+}
+
+// registered returns the messages this resource contributes to the framework's `Register`.
+func (c *viewCollector) registered() registeredViews {
+	return registeredViews{
+		send:              c.uiReceives,
+		receive:           c.uiSends,
+		controllerImports: pruneUnusedControllerImports(c.controllerImports, c.uiSends, c.uiReceives),
+	}
+}
+
+// registeredViews holds the `viewSend`/`viewReceive` maps a resource's generated file registers.
+type registeredViews struct {
+	send              []viewEntry
+	receive           []viewEntry
+	controllerImports map[string]string
+}
+
+func (v registeredViews) empty() bool {
+	return len(v.send) == 0 && len(v.receive) == 0
+}
+
+func (v registeredViews) all() []viewEntry {
+	return slices.Concat(v.send, v.receive)
+}
+
+func isViewMessageSource(path string, text string) bool {
+	if !isClientSideFile(path, text) {
+		return false
+	}
+	return strings.Contains(text, "@Client.OnView") || strings.Contains(text, ".send(")
+}
+
+func writeIfChanged(outFile string, content string) (bool, error) {
+	if existing, err := os.ReadFile(outFile); err == nil && string(existing) == content {
+		return false, nil
+	}
+	if err := os.MkdirAll(filepath.Dir(outFile), 0755); err != nil {
+		return false, err
+	}
+	if err := os.WriteFile(outFile, []byte(content), 0644); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func sortViewEntries(entries []viewEntry) {
+	slices.SortStableFunc(entries, func(a, b viewEntry) int {
+		return cmp.Or(
+			strings.Compare(a.EventName, b.EventName),
+			strings.Compare(a.PayloadType, b.PayloadType),
+		)
+	})
+}
+
+func duplicateViewWarnings(relFile string, entries []viewEntry) []SourceValidationIssue {
+	var warnings []SourceValidationIssue
+
+	for i := 1; i < len(entries); i++ {
+		previous, current := entries[i-1], entries[i]
+		if previous.EventName != current.EventName || previous.PayloadType == current.PayloadType {
+			continue
+		}
+		warnings = append(warnings, SourceValidationIssue{
+			File: relFile,
+			Message: fmt.Sprintf(
+				"WebView message %q is sent with two different payload types (%s and %s); the view is typed with the first",
+				current.EventName, previous.PayloadType, current.PayloadType,
+			),
+		})
+	}
+
+	return warnings
+}
+
+func (rb *ResourceBuilder) removeGeneratedViewTypes(resourcePath string) error {
+	viewPath := rb.viewPathFor(filepath.Clean(resourcePath))
+	if viewPath == "" {
+		return nil
+	}
+	outFile := filepath.Join(viewPath, ".opencore", viewTypegenFileName)
+	if err := os.Remove(outFile); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}
+
+// pruneUnusedControllerImports keeps only the controller aliases some rendered payload refers to.
+func pruneUnusedControllerImports(
+	controllerImports map[string]string,
+	entries ...[]viewEntry,
+) map[string]string {
+	referenced := map[string]bool{}
+	for _, entry := range slices.Concat(entries...) {
+		for _, identifier := range identifierPattern.FindAllString(entry.PayloadType, -1) {
+			referenced[identifier] = true
+		}
+	}
+
+	pruned := make(map[string]string, len(controllerImports))
+	for alias, importPath := range controllerImports {
+		if referenced[alias] {
+			pruned[alias] = importPath
+		}
+	}
+	return pruned
+}
diff --git a/internal/builder/typegen_views_test.go b/internal/builder/typegen_views_test.go
new file mode 100644
index 0000000..1bac016
--- /dev/null
+++ b/internal/builder/typegen_views_test.go
@@ -0,0 +1,533 @@
+package builder
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func readViewGenFile(t *testing.T, resourcePath string) string {
+	t.Helper()
+	content, err := os.ReadFile(filepath.Join(resourcePath, "ui", ".opencore", viewTypegenFileName))
+	if err != nil {
+		t.Fatalf("failed to read generated view file: %v", err)
+	}
+	return string(content)
+}
+
+func TestGenerateViewTypes_BothDirections(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	// A view directory must exist for view typegen to run at all.
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTestFile(t, resourcePath, "src/client/character-ui.controller.ts", `
+import { Client } from '@open-core/framework/client'
+
+@Client.Controller()
+export class CharacterUiController {
+  // UI → client: what the WebView may send.
+  @Client.OnView('character:select')
+  onSelect(payload: SelectPayload): void {}
+
+  @Client.OnView('character:ready')
+  onReady(): void {}
+
+  // client → UI: what the WebView receives. The payload forwards this handler's parameter.
+  @Client.OnNet('character:ui:open')
+  onOpen(state: CharacterUiState): void {
+    this.characterView.send('character:show', state)
+  }
+}
+`)
+
+	result, hasViews, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+	if !hasViews {
+		t.Fatal("expected the ui/ directory to be detected")
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("expected no warnings, got %v", result.Warnings)
+	}
+
+	content := readViewGenFile(t, resourcePath)
+
+	// Direction 1: names from @Client.OnView, payload = the handler's first parameter.
+	// `__Payload` rather than a bare `[0]`, so a no-arg handler does not index an empty tuple.
+	if !strings.Contains(content, "'character:select': __Payload<Parameters<") {
+		t.Fatalf("expected the UI send map to be derived from OnView handlers, got:\n%s", content)
+	}
+	if !strings.Contains(content, "'character:ready': __Payload<Parameters<") {
+		t.Fatalf("expected a no-arg handler to resolve to undefined, got:\n%s", content)
+	}
+	if !strings.Contains(content, "export type UiCanSend") {
+		t.Fatalf("expected UiCanSend, got:\n%s", content)
+	}
+
+	// Direction 2: names from send() calls, payload recovered from the enclosing handler.
+	if !strings.Contains(content, "'character:show': Parameters<") {
+		t.Fatalf("expected the UI receive map to recover the forwarded payload, got:\n%s", content)
+	}
+	if !strings.Contains(content, "export type UiReceives") {
+		t.Fatalf("expected UiReceives, got:\n%s", content)
+	}
+
+	// The UI does not depend on the framework, so nothing may be augmented.
+	if strings.Contains(content, "declare module") {
+		t.Fatalf("the view file must not augment the framework, got:\n%s", content)
+	}
+
+	// Import paths must be relative to the view's .opencore directory.
+	if !strings.Contains(content, "'../../src/client/character-ui.controller'") {
+		t.Fatalf("expected an import path relative to ui/.opencore, got:\n%s", content)
+	}
+}
+
+func TestGenerateViewTypes_HonoursConfiguredViewPath(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	viewPath := filepath.Join(resourcePath, "panel")
+	if err := os.MkdirAll(viewPath, 0755); err != nil {
+		t.Fatal(err)
+	}
+	rb.SetViewPathResolver(func(string) string { return viewPath })
+
+	writeTestFile(t, resourcePath, "src/client/a.controller.ts", `
+@Client.Controller()
+export class AController {
+  @Client.OnView('panel:submit')
+  onSubmit(payload: SubmitPayload): void {}
+}
+`)
+
+	_, hasViews, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+	if !hasViews {
+		t.Fatal("expected the configured view directory to be used")
+	}
+
+	content, err := os.ReadFile(filepath.Join(viewPath, ".opencore", viewTypegenFileName))
+	if err != nil {
+		t.Fatalf("expected the generated file in the configured view directory: %v", err)
+	}
+	if !strings.Contains(string(content), "'panel:submit'") {
+		t.Fatalf("expected the OnView handler in the generated file, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_SkipsConfiguredViewDirectory(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	viewPath := filepath.Join(resourcePath, "panel")
+	if err := os.MkdirAll(viewPath, 0755); err != nil {
+		t.Fatal(err)
+	}
+	rb.SetViewPathResolver(func(string) string { return viewPath })
+
+	writeTestFile(t, resourcePath, "panel/stray.controller.ts", `
+@Client.Controller()
+export class StrayController {
+  @Client.OnNet('panel:stray')
+  onStray(): void {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+	if strings.Contains(content, "panel:stray") {
+		t.Fatalf("the configured view directory must not be scanned as client code, got:\n%s", content)
+	}
+}
+
+func TestGenerateViewTypes_DiscoversNuiDirectory(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "nui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTestFile(t, resourcePath, "src/client/a.controller.ts", `
+@Client.Controller()
+export class AController {
+  @Client.OnView('nui:submit')
+  onSubmit(payload: SubmitPayload): void {}
+}
+`)
+
+	_, hasViews, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+	if !hasViews {
+		t.Fatal("expected nui/ to be discovered as a view directory")
+	}
+	if _, err := os.Stat(filepath.Join(resourcePath, "nui", ".opencore", viewTypegenFileName)); err != nil {
+		t.Fatalf("expected the generated file in nui/.opencore: %v", err)
+	}
+}
+
+func TestGenerateViewTypes_AttributesHandlersToTheirOwnClass(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTestFile(t, resourcePath, "src/client/pair.controller.ts", `
+@Client.Controller()
+export class FirstUiController {
+  @Client.OnView('first:submit')
+  onSubmit(payload: FirstPayload): void {}
+}
+
+@Client.Controller()
+export class SecondUiController {
+  @Client.OnView('second:submit')
+  onSecondSubmit(payload: SecondPayload): void {}
+}
+`)
+
+	if _, _, err := rb.generateViewTypes(resourcePath); err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+
+	content := readViewGenFile(t, resourcePath)
+
+	if !strings.Contains(content, "'first:submit': __Payload<Parameters<V0_FirstUiController['onSubmit']>>") {
+		t.Fatalf("expected the first handler on its own class, got:\n%s", content)
+	}
+	if !strings.Contains(content, "'second:submit': __Payload<Parameters<V1_SecondUiController['onSecondSubmit']>>") {
+		t.Fatalf("expected the second handler on SecondUiController, got:\n%s", content)
+	}
+	// Both classes come from the same file, so both aliases must import the same module.
+	if strings.Count(content, "'../../src/client/pair.controller'") != 2 {
+		t.Fatalf("expected both aliases to import the controller file, got:\n%s", content)
+	}
+}
+
+func TestGenerateViewTypes_NoViewDirectoryIsSkipped(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/client/a.controller.ts", `
+@Client.Controller()
+export class AController {
+  @Client.OnView('x:y')
+  onY(): void {}
+}
+`)
+
+	_, hasViews, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+	if hasViews {
+		t.Fatal("expected no view directory to be detected")
+	}
+}
+
+func TestGenerateViewTypes_ResolvesConstReferences(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTestFile(t, resourcePath, "src/shared/view-events.ts", `
+export const CharacterViewEvents = {
+  SELECT: 'character:select',
+  SHOW: 'character:show',
+} as const
+`)
+	writeTestFile(t, resourcePath, "src/client/ui.controller.ts", `
+import { CharacterViewEvents } from '../shared/view-events'
+
+@Client.Controller()
+export class UiController {
+  @Client.OnView(CharacterViewEvents.SELECT)
+  onSelect(payload: SelectPayload): void {}
+}
+`)
+
+	if _, _, err := rb.generateViewTypes(resourcePath); err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+
+	content := readViewGenFile(t, resourcePath)
+	want := "typeof import('../../src/shared/view-events').CharacterViewEvents['SELECT']"
+	if !strings.Contains(content, want) {
+		t.Fatalf("expected %q in the output, got:\n%s", want, content)
+	}
+}
+
+func TestGenerateViewTypes_UndefinedPayload(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTestFile(t, resourcePath, "src/client/ui.controller.ts", `
+@Client.Controller()
+export class UiController {
+  @Client.OnNet('x:clear')
+  onClear(): void {
+    this.view.send('ui:clear', undefined)
+  }
+}
+`)
+
+	if _, _, err := rb.generateViewTypes(resourcePath); err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+
+	content := readViewGenFile(t, resourcePath)
+	if !strings.Contains(content, "'ui:clear': undefined") {
+		t.Fatalf("expected an undefined payload, got:\n%s", content)
+	}
+}
+
+func TestGenerateViewTypes_NoPayloadArgumentIsUndefined(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTestFile(t, resourcePath, "src/client/ui.controller.ts", `
+@Client.Controller()
+export class UiController {
+  @Client.OnNet('x:close')
+  onClose(): void {
+    this.view.send('ui:close')
+  }
+}
+`)
+
+	result, _, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("a message with no payload is not an unresolved payload, got %v", result.Warnings)
+	}
+
+	content := readViewGenFile(t, resourcePath)
+	if !strings.Contains(content, "'ui:close': undefined") {
+		t.Fatalf("expected an undefined payload, got:\n%s", content)
+	}
+}
+
+func TestGenerateViewTypes_UnresolvablePayloadWarns(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTestFile(t, resourcePath, "src/client/ui.controller.ts", `
+@Client.Controller()
+export class UiController {
+  @Client.OnNet('bank:balanceChanged')
+  onBalanceChanged(state: BankState): void {
+    this.view.send('bank:view:render', { cash: state.cash, bank: state.bank })
+  }
+}
+`)
+
+	result, _, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+
+	if len(result.Warnings) != 1 {
+		t.Fatalf("expected one warning for the object literal payload, got %v", result.Warnings)
+	}
+	if !strings.Contains(result.Warnings[0].Message, "bank:view:render") {
+		t.Fatalf("the warning must name the message, got %q", result.Warnings[0].Message)
+	}
+
+	// The generated type still exists — the build is never failed, the gap is only reported.
+	content := readViewGenFile(t, resourcePath)
+	if !strings.Contains(content, "'bank:view:render': unknown") {
+		t.Fatalf("expected the payload to fall back to unknown, got:\n%s", content)
+	}
+}
+
+func TestGenerateViewTypes_IsIdempotent(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	writeTestFile(t, resourcePath, "src/client/ui.controller.ts", `
+@Client.Controller()
+export class UiController {
+  @Client.OnView('a:b')
+  onB(p: P): void {}
+}
+`)
+
+	first, _, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+	if !first.Changed {
+		t.Fatal("expected the first run to write the file")
+	}
+
+	second, _, err := rb.generateViewTypes(resourcePath)
+	if err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+	if second.Changed {
+		t.Fatal("expected the second run to detect no change")
+	}
+}
+
+func TestGenerateViewTypes_EmptyWhenNothingFound(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	writeTestFile(t, resourcePath, "src/client/plain.ts", `
+export class PlainService {
+  doThing() {}
+}
+`)
+
+	if _, _, err := rb.generateViewTypes(resourcePath); err != nil {
+		t.Fatalf("generateViewTypes returned error: %v", err)
+	}
+
+	content := readViewGenFile(t, resourcePath)
+	if !strings.Contains(content, "export type UiCanSend = Record<string, never>") {
+		t.Fatalf("expected empty maps, got:\n%s", content)
+	}
+}
+
+func TestGenerateTypes_RegistersViewMessages(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	writeTestFile(t, resourcePath, "src/client/hud.controller.ts", `
+@Client.Controller()
+export class HudController {
+  @Client.OnNet('hud:setState')
+  setState(state: HudState): void {
+    WebView.send('hud:state', state)
+  }
+
+  @Client.OnView('hud:close')
+  close(data: ClosePayload): void {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+	for _, want := range []string{
+		// send() feeds what the client may send into a WebView ...
+		"'hud:state': Parameters<V0_HudController['setState']>[0]",
+		"viewSend: GenViewSend",
+		// ... and @Client.OnView what a WebView may send back.
+		"'hud:close': __Payload<Parameters<V0_HudController['close']>>",
+		"viewReceive: GenViewReceive",
+		"type __Payload<",
+		// Imports are relative to the resource's own .opencore/, not to a view directory.
+		"import('../src/client/hud.controller').HudController",
+	} {
+		if !strings.Contains(content, want) {
+			t.Fatalf("expected %q in the generated file, got:\n%s", want, content)
+		}
+	}
+}
+
+func TestGenerateTypes_RegistersViewMessagesWithoutAViewDirectory(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	// The WebView a client talks to may live in another resource, so there is no ui/ here.
+	writeTestFile(t, resourcePath, "src/client/hud.controller.ts", `
+@Client.Controller()
+export class HudController {
+  @Client.OnView('hud:close')
+  close(): void {}
+}
+`)
+
+	if _, err := rb.generateTypes(resourcePath, TypegenOptions{}); err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+
+	content := readGenFile(t, resourcePath)
+	if !strings.Contains(content, "viewReceive: GenViewReceive") {
+		t.Fatalf("expected the view map to be registered, got:\n%s", content)
+	}
+	if strings.Contains(content, "viewSend:") {
+		t.Fatalf("expected no viewSend map without send() calls, got:\n%s", content)
+	}
+	if _, err := os.Stat(filepath.Join(resourcePath, "ui", ".opencore")); !os.IsNotExist(err) {
+		t.Fatalf("expected no view file without a view directory, stat err: %v", err)
+	}
+}
+
+func TestGenerateTypes_ReportsUnresolvedViewPayloadOnce(t *testing.T) {
+	resourcePath := t.TempDir()
+	rb := NewResourceBuilder(".")
+
+	if err := os.MkdirAll(filepath.Join(resourcePath, "ui"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	writeTestFile(t, resourcePath, "src/client/hud.controller.ts", `
+@Client.Controller()
+export class HudController {
+  @Client.OnNet('hud:setCash')
+  setCash(amount: number): void {
+    WebView.send('hud:update', { cash: amount })
+  }
+}
+`)
+
+	result, err := rb.generateTypes(resourcePath, TypegenOptions{})
+	if err != nil {
+		t.Fatalf("generateTypes returned error: %v", err)
+	}
+	if len(result.Warnings) != 1 || !strings.HasPrefix(result.Warnings[0].Message, viewPayloadUnresolvedPrefix) {
+		t.Fatalf("expected the unresolved payload warning, got %v", result.Warnings)
+	}
+	if content := readGenFile(t, resourcePath); !strings.Contains(content, "'hud:update': unknown") {
+		t.Fatalf("expected an unresolved payload to register as unknown, got:\n%s", content)
+	}
+}
+
+func TestRenderTypegenFile_EmptyWithoutHandlersOrViews(t *testing.T) {
+	content := renderTypegenFile(nil, registeredViews{}, TypegenOptions{ResourceKey: "resource:x"})
+	if !strings.HasSuffix(content, "export {};\n") || strings.Contains(content, "declare module") {
+		t.Fatalf("expected an empty module, got:\n%s", content)
+	}
+}
diff --git a/internal/commands/clone.go b/internal/commands/clone.go
index d89bd89..c699209 100644
--- a/internal/commands/clone.go
+++ b/internal/commands/clone.go
@@ -1,6 +1,7 @@
 package commands
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -8,10 +9,12 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/charmbracelet/bubbles/spinner"
 	tea "github.com/charmbracelet/bubbletea"
@@ -20,15 +23,30 @@ import (
 
 	"github.com/newcore-network/opencore-cli/internal/config"
 	"github.com/newcore-network/opencore-cli/internal/pkgmgr"
+	"github.com/newcore-network/opencore-cli/internal/templates"
 	"github.com/newcore-network/opencore-cli/internal/ui"
 )
 
 const (
-	templatesRepo = "newcore-network/opencore-templates"
-	templatesURL  = "https://github.com/" + templatesRepo
-	apiBaseURL    = "https://api.github.com/repos/" + templatesRepo + "/contents"
+	templatesRepo  = "newcore-network/opencore-templates"
+	templatesURL   = "https://github.com/" + templatesRepo
+	apiBaseURL     = "https://api.github.com/repos/" + templatesRepo + "/contents"
+	apiBodyLimit   = 2 << 20
+	manifestLimit  = 1 << 20
+	fileBodyLimit  = 50 << 20
+	cloneBodyLimit = 200 << 20
 )
 
+var cloneHTTPClient = &http.Client{
+	Timeout: 30 * time.Second,
+	CheckRedirect: func(req *http.Request, _ []*http.Request) error {
+		if !isTrustedGitHubURL(req.URL) {
+			return fmt.Errorf("refusing redirect to untrusted URL %q", req.URL.String())
+		}
+		return nil
+	},
+}
+
 // GitHubContent represents a file/directory from GitHub API
 type GitHubContent struct {
 	Name        string `json:"name"`
@@ -63,17 +81,26 @@ Examples:
 		Args: func(cmd *cobra.Command, args []string) error {
 			listFlag, _ := cmd.Flags().GetBool("list")
 			if listFlag {
+				if len(args) != 0 {
+					return fmt.Errorf("--list does not accept a template name")
+				}
 				return nil
 			}
-			if len(args) < 1 {
+			if len(args) == 0 {
 				return fmt.Errorf("missing template name\n\nUse 'opencore clone --list' to see available templates\n\nUsage: opencore clone <template>")
 			}
+			if len(args) > 1 {
+				return fmt.Errorf("expected exactly one template name")
+			}
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			branch = normalizeBranch(branch)
+			if err := validateBranch(branch); err != nil {
+				return err
+			}
 			if listTemplates {
-				return runListTemplates(branch)
+				return runListTemplates(cmd.Context(), branch)
 			}
 			return runClone(cmd, args, useAPI, force, branch)
 		},
@@ -96,12 +123,21 @@ func normalizeBranch(branch string) string {
 	return trimmed
 }
 
-func runListTemplates(branch string) error {
+func validateBranch(branch string) error {
+	if strings.HasPrefix(branch, "-") || strings.ContainsAny(branch, "\\\x00 ~^:?*[") ||
+		strings.Contains(branch, "..") || strings.Contains(branch, "@{") || strings.Contains(branch, "//") ||
+		strings.HasSuffix(branch, "/") || strings.HasSuffix(branch, ".") || strings.HasSuffix(branch, ".lock") {
+		return fmt.Errorf("invalid branch name %q", branch)
+	}
+	return nil
+}
+
+func runListTemplates(ctx context.Context, branch string) error {
 	fmt.Println(ui.Logo())
 	fmt.Println(ui.TitleStyle.Render("Available Templates"))
 	fmt.Println()
 
-	resources, standalones, err := fetchGroupedTemplates(branch)
+	resources, standalones, err := fetchGroupedTemplates(ctx, branch)
 	if err != nil {
 		return fmt.Errorf("failed to fetch templates: %w", err)
 	}
@@ -147,9 +183,9 @@ func buildContentsAPIURL(path, branch string) string {
 }
 
 // fetchGroupedTemplates fetches templates grouped by category (resources vs standalones)
-func fetchGroupedTemplates(branch string) (resources []templateDescriptor, standalones []templateDescriptor, err error) {
+func fetchGroupedTemplates(ctx context.Context, branch string) (resources []templateDescriptor, standalones []templateDescriptor, err error) {
 	// Fetch root contents
-	resp, err := http.Get(buildContentsAPIURL("", branch))
+	resp, err := cloneGET(ctx, buildContentsAPIURL("", branch))
 	if err != nil {
 		return nil, nil, err
 	}
@@ -163,7 +199,7 @@ func fetchGroupedTemplates(branch string) (resources []templateDescriptor, stand
 	}
 
 	var contents []GitHubContent
-	if err := json.NewDecoder(resp.Body).Decode(&contents); err != nil {
+	if err := decodeLimitedJSON(resp.Body, apiBodyLimit, &contents); err != nil {
 		return nil, nil, err
 	}
 
@@ -177,13 +213,13 @@ func fetchGroupedTemplates(branch string) (resources []templateDescriptor, stand
 		switch item.Name {
 		case "resources":
 			// Fetch contents of resources/
-			resourceList, err := fetchFolderContents("resources", templateCategoryResource, branch)
+			resourceList, err := fetchFolderContents(ctx, "resources", templateCategoryResource, branch)
 			if err == nil {
 				resources = resourceList
 			}
 		case "standalones", "standalone":
 			// Fetch contents of standalones/ or standalone/
-			standaloneList, err := fetchFolderContents(item.Name, templateCategoryStandalone, branch)
+			standaloneList, err := fetchFolderContents(ctx, item.Name, templateCategoryStandalone, branch)
 			if err == nil {
 				standalones = standaloneList
 			}
@@ -194,9 +230,9 @@ func fetchGroupedTemplates(branch string) (resources []templateDescriptor, stand
 }
 
 // fetchFolderContents fetches the list of directories inside a folder
-func fetchFolderContents(folderPath string, category templateCategory, branch string) ([]templateDescriptor, error) {
+func fetchFolderContents(ctx context.Context, folderPath string, category templateCategory, branch string) ([]templateDescriptor, error) {
 	requestURL := buildContentsAPIURL(folderPath, branch)
-	resp, err := http.Get(requestURL)
+	resp, err := cloneGET(ctx, requestURL)
 	if err != nil {
 		return nil, err
 	}
@@ -207,7 +243,7 @@ func fetchFolderContents(folderPath string, category templateCategory, branch st
 	}
 
 	var contents []GitHubContent
-	if err := json.NewDecoder(resp.Body).Decode(&contents); err != nil {
+	if err := decodeLimitedJSON(resp.Body, apiBodyLimit, &contents); err != nil {
 		return nil, err
 	}
 
@@ -216,7 +252,7 @@ func fetchFolderContents(folderPath string, category templateCategory, branch st
 		// Only include directories, skip files and _ folders
 		if item.Type == "dir" && !strings.HasPrefix(item.Name, "_") {
 			repoPath := folderPath + "/" + item.Name
-			manifest, manifestErr := fetchTemplateManifest(repoPath, branch)
+			manifest, manifestErr := fetchTemplateManifest(ctx, repoPath, branch)
 			if manifestErr == nil {
 				manifestErr = validateManifestCategory(manifest, category)
 			}
@@ -234,9 +270,9 @@ func fetchFolderContents(folderPath string, category templateCategory, branch st
 	return items, nil
 }
 
-func fetchTemplateManifest(templatePath, branch string) (*templateManifest, error) {
+func fetchTemplateManifest(ctx context.Context, templatePath, branch string) (*templateManifest, error) {
 	requestURL := buildContentsAPIURL(templatePath, branch)
-	resp, err := http.Get(requestURL)
+	resp, err := cloneGET(ctx, requestURL)
 	if err != nil {
 		return nil, err
 	}
@@ -247,7 +283,7 @@ func fetchTemplateManifest(templatePath, branch string) (*templateManifest, erro
 	}
 
 	var contents []GitHubContent
-	if err := json.NewDecoder(resp.Body).Decode(&contents); err != nil {
+	if err := decodeLimitedJSON(resp.Body, apiBodyLimit, &contents); err != nil {
 		return nil, err
 	}
 
@@ -255,8 +291,11 @@ func fetchTemplateManifest(templatePath, branch string) (*templateManifest, erro
 		if item.Type != "file" || item.Name != ocManifestFileName || item.DownloadURL == "" {
 			continue
 		}
+		if err := validateDownloadURL(item.DownloadURL); err != nil {
+			return nil, err
+		}
 
-		manifestResp, err := http.Get(item.DownloadURL)
+		manifestResp, err := cloneGET(ctx, item.DownloadURL)
 		if err != nil {
 			return nil, err
 		}
@@ -266,7 +305,7 @@ func fetchTemplateManifest(templatePath, branch string) (*templateManifest, erro
 			return nil, fmt.Errorf("failed to download %s: status %d", ocManifestFileName, manifestResp.StatusCode)
 		}
 
-		body, err := io.ReadAll(manifestResp.Body)
+		body, err := readLimited(manifestResp.Body, manifestLimit)
 		if err != nil {
 			return nil, err
 		}
@@ -278,13 +317,13 @@ func fetchTemplateManifest(templatePath, branch string) (*templateManifest, erro
 }
 
 // resolveTemplatePaths determines the source path in the repo and target path locally
-func resolveTemplate(templateName, branch string) (templateDescriptor, error) {
+func resolveTemplate(ctx context.Context, templateName, branch string) (templateDescriptor, error) {
 	// Prevent cloning container folders
 	if templateName == "resources" || templateName == "standalones" || templateName == "standalone" {
 		return templateDescriptor{}, fmt.Errorf("cannot clone container folders directly\n\nUse 'opencore clone --list' to see available templates")
 	}
 
-	resources, standalones, err := fetchGroupedTemplates(branch)
+	resources, standalones, err := fetchGroupedTemplates(ctx, branch)
 	if err != nil {
 		return templateDescriptor{}, fmt.Errorf("failed to fetch templates: %w", err)
 	}
@@ -307,35 +346,8 @@ func resolveTemplate(templateName, branch string) (templateDescriptor, error) {
 	return templateDescriptor{}, fmt.Errorf("template '%s' not found in branch '%s'\n\nUse 'opencore clone --list --branch %s' to see available templates", templateName, branch, branch)
 }
 
-func fetchTemplateList() ([]string, error) {
-	resp, err := http.Get(apiBaseURL)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		return nil, fmt.Errorf("GitHub API returned status %d", resp.StatusCode)
-	}
-
-	var contents []GitHubContent
-	if err := json.NewDecoder(resp.Body).Decode(&contents); err != nil {
-		return nil, err
-	}
-
-	var templates []string
-	for _, item := range contents {
-		// Only include directories, skip files like README.md
-		// Also skip directories starting with _ (system folders)
-		if item.Type == "dir" && !strings.HasPrefix(item.Name, "_") {
-			templates = append(templates, item.Name)
-		}
-	}
-
-	return templates, nil
-}
-
 type cloneModel struct {
+	ctx        context.Context
 	spinner    spinner.Model
 	template   string // Display name (e.g., "chat")
 	sourcePath string // Full path in repo (e.g., "resources/chat")
@@ -402,6 +414,8 @@ type cloneResultMsg struct {
 
 func (m cloneModel) startClone() tea.Cmd {
 	return func() tea.Msg {
+		ctx, cancel := context.WithTimeout(m.ctx, 5*time.Minute)
+		defer cancel()
 		// Check if directory already exists
 		if _, err := os.Stat(m.targetPath); !os.IsNotExist(err) {
 			return cloneResultMsg{err: fmt.Errorf("directory '%s' already exists", m.targetPath)}
@@ -409,7 +423,7 @@ func (m cloneModel) startClone() tea.Cmd {
 
 		// Try sparse checkout first if git >= 2.25 and not forced to use API
 		if !m.useAPI && canUseSparseCheckout() {
-			err := cloneWithSparseCheckout(m.sourcePath, m.targetPath, m.branch)
+			err := cloneWithSparseCheckout(ctx, m.sourcePath, m.targetPath, m.branch)
 			if err == nil {
 				return cloneResultMsg{err: nil}
 			}
@@ -417,7 +431,7 @@ func (m cloneModel) startClone() tea.Cmd {
 		}
 
 		// Use GitHub API
-		err := cloneWithGitHubAPI(m.sourcePath, m.targetPath, m.branch)
+		err := cloneWithGitHubAPI(ctx, m.sourcePath, m.targetPath, m.branch)
 		return cloneResultMsg{err: err}
 	}
 }
@@ -444,8 +458,11 @@ func canUseSparseCheckout() bool {
 }
 
 // cloneWithSparseCheckout uses git sparse-checkout to clone only the template folder
-func cloneWithSparseCheckout(template, targetPath, branch string) error {
-	tempDir, err := os.MkdirTemp("", "opencore-clone-*")
+func cloneWithSparseCheckout(ctx context.Context, templatePath, targetPath, branch string) error {
+	if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
+		return err
+	}
+	tempDir, err := os.MkdirTemp(filepath.Dir(targetPath), ".opencore-clone-*")
 	if err != nil {
 		return err
 	}
@@ -459,7 +476,7 @@ func cloneWithSparseCheckout(template, targetPath, branch string) error {
 	}
 
 	for _, args := range cmds {
-		cmd := exec.Command(args[0], args[1:]...)
+		cmd := exec.CommandContext(ctx, args[0], args[1:]...)
 		cmd.Dir = tempDir
 		if err := cmd.Run(); err != nil {
 			return fmt.Errorf("git command failed: %w", err)
@@ -468,66 +485,75 @@ func cloneWithSparseCheckout(template, targetPath, branch string) error {
 
 	// Configure sparse-checkout
 	sparseFile := filepath.Join(tempDir, ".git", "info", "sparse-checkout")
-	if err := os.WriteFile(sparseFile, []byte(template+"/\n"), 0644); err != nil {
+	if err := os.WriteFile(sparseFile, []byte(templatePath+"/\n"), 0644); err != nil {
 		return err
 	}
 
 	// Pull
-	cmd := exec.Command("git", "pull", "origin", branch, "--depth=1")
+	cmd := exec.CommandContext(ctx, "git", "pull", "--depth=1", "origin", branch)
 	cmd.Dir = tempDir
 	if err := cmd.Run(); err != nil {
 		return fmt.Errorf("git pull failed: %w", err)
 	}
 
 	// Move template folder to target
-	srcPath := filepath.Join(tempDir, template)
+	srcPath := filepath.Join(tempDir, filepath.FromSlash(templatePath))
 	if _, err := os.Stat(srcPath); os.IsNotExist(err) {
-		return fmt.Errorf("template '%s' not found in repository", template)
+		return fmt.Errorf("template '%s' not found in repository", templatePath)
 	}
 
-	// Create parent directory if needed
-	if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
-		return err
+	if _, err := os.Lstat(targetPath); err == nil || !os.IsNotExist(err) {
+		return fmt.Errorf("target path '%s' already exists", targetPath)
 	}
-
-	// Move the folder
 	if err := os.Rename(srcPath, targetPath); err != nil {
-		// If rename fails (cross-device), copy instead
-		return copyDir(srcPath, targetPath)
+		return fmt.Errorf("failed to publish cloned template: %w", err)
 	}
 
 	return nil
 }
 
 // cloneWithGitHubAPI downloads template using GitHub API
-func cloneWithGitHubAPI(template, targetPath, branch string) error {
+func cloneWithGitHubAPI(ctx context.Context, templatePath, targetPath, branch string) error {
 	// First verify template exists
-	apiURL := buildContentsAPIURL(template, branch)
-	resp, err := http.Get(apiURL)
+	apiURL := buildContentsAPIURL(templatePath, branch)
+	resp, err := cloneGET(ctx, apiURL)
 	if err != nil {
 		return fmt.Errorf("failed to connect to GitHub: %w", err)
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode == 404 {
-		return fmt.Errorf("template '%s' not found in branch '%s'. Use 'opencore clone --list --branch %s' to see available templates", template, branch, branch)
+		return fmt.Errorf("template '%s' not found in branch '%s'. Use 'opencore clone --list --branch %s' to see available templates", templatePath, branch, branch)
 	}
 	if resp.StatusCode != 200 {
 		return fmt.Errorf("GitHub API error: status %d", resp.StatusCode)
 	}
 
-	// Create target directory
-	if err := os.MkdirAll(targetPath, 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
+		return err
+	}
+	stagingPath, err := os.MkdirTemp(filepath.Dir(targetPath), ".opencore-download-*")
+	if err != nil {
 		return err
 	}
+	defer os.RemoveAll(stagingPath)
 
-	// Download recursively
-	return downloadDirectory(template, targetPath, branch)
+	budget := int64(cloneBodyLimit)
+	if err := downloadDirectory(ctx, templatePath, stagingPath, branch, &budget); err != nil {
+		return err
+	}
+	if _, err := os.Lstat(targetPath); err == nil || !os.IsNotExist(err) {
+		return fmt.Errorf("target path '%s' already exists", targetPath)
+	}
+	if err := os.Rename(stagingPath, targetPath); err != nil {
+		return fmt.Errorf("failed to publish downloaded template: %w", err)
+	}
+	return nil
 }
 
-func downloadDirectory(remotePath, localPath, branch string) error {
+func downloadDirectory(ctx context.Context, remotePath, localPath, branch string, budget *int64) error {
 	apiURL := buildContentsAPIURL(remotePath, branch)
-	resp, err := http.Get(apiURL)
+	resp, err := cloneGET(ctx, apiURL)
 	if err != nil {
 		return err
 	}
@@ -538,78 +564,73 @@ func downloadDirectory(remotePath, localPath, branch string) error {
 	}
 
 	var contents []GitHubContent
-	if err := json.NewDecoder(resp.Body).Decode(&contents); err != nil {
+	if err := decodeLimitedJSON(resp.Body, apiBodyLimit, &contents); err != nil {
 		return err
 	}
 
 	for _, item := range contents {
+		if err := validateGitHubItem(remotePath, item); err != nil {
+			return err
+		}
 		localItemPath := filepath.Join(localPath, item.Name)
 
 		if item.Type == "dir" {
 			if err := os.MkdirAll(localItemPath, 0755); err != nil {
 				return err
 			}
-			if err := downloadDirectory(item.Path, localItemPath, branch); err != nil {
+			if err := downloadDirectory(ctx, item.Path, localItemPath, branch, budget); err != nil {
 				return err
 			}
-		} else {
-			if err := downloadFile(item.DownloadURL, localItemPath); err != nil {
+		} else if item.Type == "file" {
+			if err := downloadFile(ctx, item.DownloadURL, localItemPath, budget); err != nil {
 				return err
 			}
+		} else {
+			return fmt.Errorf("unsupported GitHub item type %q for %s", item.Type, item.Path)
 		}
 	}
 
 	return nil
 }
 
-func downloadFile(url, localPath string) error {
-	resp, err := http.Get(url)
+func downloadFile(ctx context.Context, downloadURL, localPath string, budget *int64) error {
+	if err := validateDownloadURL(downloadURL); err != nil {
+		return err
+	}
+	resp, err := cloneGET(ctx, downloadURL)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("download returned status %d", resp.StatusCode)
+	}
+	limit := int64(fileBodyLimit)
+	if *budget < limit {
+		limit = *budget
+	}
+	if limit <= 0 || (resp.ContentLength >= 0 && resp.ContentLength > limit) {
+		return fmt.Errorf("download exceeds size limit")
+	}
 
-	file, err := os.Create(localPath)
+	file, err := os.OpenFile(localPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0644)
 	if err != nil {
 		return err
 	}
-	defer file.Close()
-
-	_, err = io.Copy(file, resp.Body)
-	return err
-}
-
-func copyDir(src, dst string) error {
-	return filepath.Walk(src, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-
-		relPath, err := filepath.Rel(src, path)
-		if err != nil {
-			return err
-		}
-		targetPath := filepath.Join(dst, relPath)
-
-		if info.IsDir() {
-			return os.MkdirAll(targetPath, info.Mode())
-		}
-
-		srcFile, err := os.Open(path)
-		if err != nil {
-			return err
+	written, copyErr := io.Copy(file, io.LimitReader(resp.Body, limit+1))
+	closeErr := file.Close()
+	if copyErr != nil || closeErr != nil || written > limit {
+		_ = os.Remove(localPath)
+		if copyErr != nil {
+			return copyErr
 		}
-		defer srcFile.Close()
-
-		dstFile, err := os.Create(targetPath)
-		if err != nil {
-			return err
+		if closeErr != nil {
+			return closeErr
 		}
-		defer dstFile.Close()
-
-		_, err = io.Copy(dstFile, srcFile)
-		return err
-	})
+		return fmt.Errorf("download exceeds size limit")
+	}
+	*budget -= written
+	return nil
 }
 
 func runClone(cmd *cobra.Command, args []string, forceAPI bool, force bool, branch string) error {
@@ -618,9 +639,8 @@ func runClone(cmd *cobra.Command, args []string, forceAPI bool, force bool, bran
 
 	templateName := args[0]
 
-	// Validate template name (basic sanitization)
-	if strings.Contains(templateName, "/") || strings.Contains(templateName, "..") {
-		return fmt.Errorf("invalid template name: %s", templateName)
+	if err := templates.ValidateName(templateName); err != nil {
+		return fmt.Errorf("invalid template name: %w", err)
 	}
 
 	// Prevent cloning system folders (folders starting with _)
@@ -628,11 +648,14 @@ func runClone(cmd *cobra.Command, args []string, forceAPI bool, force bool, bran
 		return fmt.Errorf("cannot clone system folders (folders starting with '_')\n\nUse 'opencore clone --list' to see available templates")
 	}
 
-	template, err := resolveTemplate(templateName, branch)
+	template, err := resolveTemplate(cmd.Context(), templateName, branch)
 	if err != nil {
 		return err
 	}
 	if template.ManifestError != nil {
+		if _, invalid := template.ManifestError.(*manifestValidationError); invalid {
+			return fmt.Errorf("template '%s' has an invalid manifest: %w", template.Name, template.ManifestError)
+		}
 		fmt.Println(ui.Warning(fmt.Sprintf("Skipping manifest checks for '%s': %v", template.Name, template.ManifestError)))
 		fmt.Println()
 	}
@@ -658,6 +681,7 @@ func runClone(cmd *cobra.Command, args []string, forceAPI bool, force bool, bran
 	s.Style = lipgloss.NewStyle().Foreground(ui.PrimaryColor)
 
 	m := cloneModel{
+		ctx:        cmd.Context(),
 		spinner:    s,
 		template:   templateName,
 		sourcePath: template.SourcePath,
@@ -688,6 +712,68 @@ func runClone(cmd *cobra.Command, args []string, forceAPI bool, force bool, bran
 	return nil
 }
 
+func cloneGET(ctx context.Context, requestURL string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("User-Agent", "opencore-cli")
+	return cloneHTTPClient.Do(req)
+}
+
+func validateDownloadURL(downloadURL string) error {
+	parsedURL, err := url.Parse(downloadURL)
+	if err != nil || parsedURL.Scheme != "https" || parsedURL.Hostname() != "raw.githubusercontent.com" || parsedURL.User != nil {
+		return fmt.Errorf("refusing untrusted download URL %q", downloadURL)
+	}
+	return nil
+}
+
+func isTrustedGitHubURL(candidate *url.URL) bool {
+	if candidate == nil || candidate.Scheme != "https" || candidate.User != nil {
+		return false
+	}
+	switch candidate.Hostname() {
+	case "api.github.com", "raw.githubusercontent.com":
+		return true
+	default:
+		return false
+	}
+}
+
+func readLimited(reader io.Reader, limit int64) ([]byte, error) {
+	body, err := io.ReadAll(io.LimitReader(reader, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(body)) > limit {
+		return nil, fmt.Errorf("response exceeds %d-byte size limit", limit)
+	}
+	return body, nil
+}
+
+func decodeLimitedJSON(reader io.Reader, limit int64, target any) error {
+	body, err := readLimited(reader, limit)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(body, target); err != nil {
+		return fmt.Errorf("invalid JSON response: %w", err)
+	}
+	return nil
+}
+
+func validateGitHubItem(parent string, item GitHubContent) error {
+	if item.Name == "" || item.Name == "." || item.Name == ".." || strings.ContainsAny(item.Name, `/\`) || path.Base(item.Name) != item.Name || filepath.Base(item.Name) != item.Name {
+		return fmt.Errorf("unsafe item name %q returned by GitHub", item.Name)
+	}
+	if item.Path != path.Join(parent, item.Name) {
+		return fmt.Errorf("unexpected item path %q returned by GitHub", item.Path)
+	}
+	return nil
+}
+
 func applyPostCloneRuntimeAdjustments(targetPath, runtime string) error {
 	if runtime != "ragemp" {
 		return nil
diff --git a/internal/commands/clone_manifest.go b/internal/commands/clone_manifest.go
index d8ee999..cbaeb90 100644
--- a/internal/commands/clone_manifest.go
+++ b/internal/commands/clone_manifest.go
@@ -4,15 +4,15 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"regexp"
+	"io"
 	"sort"
 	"strings"
+
+	"github.com/newcore-network/opencore-cli/internal/templates"
 )
 
 const ocManifestFileName = "oc.manifest.json"
 
-var manifestNamePattern = regexp.MustCompile(`^[a-z0-9][a-z0-9-_]*$`)
-
 type manifestValidationError struct {
 	message string
 }
@@ -71,17 +71,22 @@ func parseTemplateManifest(data []byte) (*templateManifest, error) {
 	if err := decoder.Decode(manifest); err != nil {
 		return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: %v", ocManifestFileName, err)}
 	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		if err == nil {
+			err = fmt.Errorf("multiple JSON values")
+		}
+		return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: trailing data: %v", ocManifestFileName, err)}
+	}
 
 	if manifest.Version != 1 {
 		return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: schemaVersion must be 1", ocManifestFileName)}
 	}
 
-	manifest.Name = strings.TrimSpace(manifest.Name)
-	if manifest.Name == "" {
-		return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: name is required", ocManifestFileName)}
+	if err := templates.ValidateName(manifest.Name); err != nil {
+		return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: invalid name: %v", ocManifestFileName, err)}
 	}
-	if !manifestNamePattern.MatchString(manifest.Name) {
-		return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: name must match %s", ocManifestFileName, manifestNamePattern.String())}
+	if manifest.DisplayName == "" && manifestFieldPresent(data, "displayName") {
+		return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: displayName cannot be empty", ocManifestFileName)}
 	}
 
 	switch manifest.Kind {
@@ -91,23 +96,48 @@ func parseTemplateManifest(data []byte) (*templateManifest, error) {
 	}
 
 	if manifest.Compatibility != nil {
+		seenRuntimes := make(map[string]struct{}, len(manifest.Compatibility.Runtimes))
 		for _, runtime := range manifest.Compatibility.Runtimes {
 			if !isSupportedManifestRuntime(runtime) {
 				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: unsupported runtime '%s'", ocManifestFileName, runtime)}
 			}
+			if _, exists := seenRuntimes[runtime]; exists {
+				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: duplicate runtime '%s'", ocManifestFileName, runtime)}
+			}
+			seenRuntimes[runtime] = struct{}{}
 		}
+		seenProfiles := make(map[string]struct{}, len(manifest.Compatibility.GameProfiles))
 		for _, profile := range manifest.Compatibility.GameProfiles {
 			if !isSupportedManifestGameProfile(profile) {
 				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: unsupported gameProfile '%s'", ocManifestFileName, profile)}
 			}
+			if _, exists := seenProfiles[profile]; exists {
+				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: duplicate gameProfile '%s'", ocManifestFileName, profile)}
+			}
+			seenProfiles[profile] = struct{}{}
 		}
 	}
 
 	if manifest.Requires != nil {
+		seenDependencies := make(map[string]struct{}, len(manifest.Requires.Templates))
 		for _, dependency := range manifest.Requires.Templates {
-			dep := strings.TrimSpace(dependency)
-			if dep == "" {
-				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: requires.templates cannot contain empty values", ocManifestFileName)}
+			if err := templates.ValidateName(dependency); err != nil {
+				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: invalid required template '%s': %v", ocManifestFileName, dependency, err)}
+			}
+			if _, exists := seenDependencies[dependency]; exists {
+				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: duplicate required template '%s'", ocManifestFileName, dependency)}
+			}
+			seenDependencies[dependency] = struct{}{}
+		}
+	}
+	if manifest.Links != nil {
+		for field, value := range map[string]string{
+			"readme":     manifest.Links.Readme,
+			"docs":       manifest.Links.Docs,
+			"repository": manifest.Links.Repository,
+		} {
+			if value == "" && manifestNestedFieldPresent(data, "links", field) {
+				return nil, &manifestValidationError{message: fmt.Sprintf("invalid %s: links.%s cannot be empty", ocManifestFileName, field)}
 			}
 		}
 	}
@@ -115,6 +145,28 @@ func parseTemplateManifest(data []byte) (*templateManifest, error) {
 	return manifest, nil
 }
 
+func manifestFieldPresent(data []byte, field string) bool {
+	var raw map[string]json.RawMessage
+	if json.Unmarshal(data, &raw) != nil {
+		return false
+	}
+	_, ok := raw[field]
+	return ok
+}
+
+func manifestNestedFieldPresent(data []byte, parent, field string) bool {
+	var raw map[string]json.RawMessage
+	if json.Unmarshal(data, &raw) != nil {
+		return false
+	}
+	var nested map[string]json.RawMessage
+	if json.Unmarshal(raw[parent], &nested) != nil {
+		return false
+	}
+	_, ok := nested[field]
+	return ok
+}
+
 func validateManifestCategory(manifest *templateManifest, category templateCategory) error {
 	if manifest == nil {
 		return nil
diff --git a/internal/commands/clone_manifest_test.go b/internal/commands/clone_manifest_test.go
index 6721bcb..9f7463a 100644
--- a/internal/commands/clone_manifest_test.go
+++ b/internal/commands/clone_manifest_test.go
@@ -60,6 +60,35 @@ func TestParseTemplateManifestRejectsInvalidRuntime(t *testing.T) {
 	}
 }
 
+func TestParseTemplateManifestRejectsUnsafeNamesAndTrailingJSON(t *testing.T) {
+	for _, name := range []string{"Chat", "chat.name", "chat:name", "../chat"} {
+		data := []byte(`{"schemaVersion":1,"name":"` + name + `","kind":"resource"}`)
+		if _, err := parseTemplateManifest(data); err == nil {
+			t.Errorf("expected name %q to be rejected", name)
+		}
+	}
+
+	if _, err := parseTemplateManifest([]byte(`{"schemaVersion":1,"name":"chat","kind":"resource"} {}`)); err == nil {
+		t.Fatal("expected trailing JSON value to be rejected")
+	}
+}
+
+func TestParseTemplateManifestRejectsDuplicateAndInvalidNestedValues(t *testing.T) {
+	cases := []string{
+		`{"schemaVersion":1,"name":"chat","kind":"resource","compatibility":{"runtimes":["fivem","fivem"]}}`,
+		`{"schemaVersion":1,"name":"chat","kind":"resource","compatibility":{"gameProfiles":["gta5","gta5"]}}`,
+		`{"schemaVersion":1,"name":"chat","kind":"resource","requires":{"templates":["../core"]}}`,
+		`{"schemaVersion":1,"name":"chat","kind":"resource","requires":{"templates":["core","core"]}}`,
+		`{"schemaVersion":1,"name":"chat","displayName":"","kind":"resource"}`,
+		`{"schemaVersion":1,"name":"chat","kind":"resource","links":{"readme":""}}`,
+	}
+	for _, data := range cases {
+		if _, err := parseTemplateManifest([]byte(data)); err == nil {
+			t.Errorf("expected invalid manifest to be rejected: %s", data)
+		}
+	}
+}
+
 func TestValidateManifestCompatibilityAllowsUnknownManifest(t *testing.T) {
 	descriptor := templateDescriptor{Name: "xchat"}
 	if err := validateManifestCompatibility(descriptor, "ragemp"); err != nil {
diff --git a/internal/commands/clone_security_test.go b/internal/commands/clone_security_test.go
new file mode 100644
index 0000000..89d3e6f
--- /dev/null
+++ b/internal/commands/clone_security_test.go
@@ -0,0 +1,120 @@
+package commands
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+)
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func TestValidateBranchRejectsOptionAndInvalidRefs(t *testing.T) {
+	for _, branch := range []string{"main", "feature/security", "release-1.0"} {
+		if err := validateBranch(branch); err != nil {
+			t.Errorf("expected branch %q to be valid: %v", branch, err)
+		}
+	}
+	for _, branch := range []string{"--upload-pack=evil", "feature..test", "feature//test", "bad branch", "main.lock"} {
+		if err := validateBranch(branch); err == nil {
+			t.Errorf("expected branch %q to be invalid", branch)
+		}
+	}
+}
+
+func TestValidateGitHubItemRejectsTraversal(t *testing.T) {
+	for _, item := range []GitHubContent{
+		{Name: "../escape", Path: "resources/escape", Type: "file"},
+		{Name: "safe.txt", Path: "other/safe.txt", Type: "file"},
+		{Name: `..\escape`, Path: `resources/chat/..\escape`, Type: "file"},
+	} {
+		if err := validateGitHubItem("resources/chat", item); err == nil {
+			t.Errorf("expected item %#v to be rejected", item)
+		}
+	}
+}
+
+func TestReadLimitedRejectsOversizedResponse(t *testing.T) {
+	if _, err := readLimited(strings.NewReader("12345"), 4); err == nil {
+		t.Fatal("expected response size error")
+	}
+}
+
+func TestDownloadFileChecksStatusAndDoesNotCreateFile(t *testing.T) {
+	originalClient := cloneHTTPClient
+	cloneHTTPClient = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return &http.Response{
+			StatusCode: http.StatusNotFound,
+			Body:       io.NopCloser(strings.NewReader("missing")),
+			Header:     make(http.Header),
+			Request:    req,
+		}, nil
+	})}
+	t.Cleanup(func() { cloneHTTPClient = originalClient })
+
+	budget := int64(cloneBodyLimit)
+	target := t.TempDir() + "/download.txt"
+	err := downloadFile(context.Background(), "https://raw.githubusercontent.com/example/repo/main/file", target, &budget)
+	if err == nil || !strings.Contains(err.Error(), "status 404") {
+		t.Fatalf("expected status error, got %v", err)
+	}
+	if _, statErr := os.Stat(target); !os.IsNotExist(statErr) {
+		t.Fatalf("download target should not exist, stat error: %v", statErr)
+	}
+}
+
+func TestDownloadFileEnforcesRemainingBudget(t *testing.T) {
+	originalClient := cloneHTTPClient
+	cloneHTTPClient = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return &http.Response{
+			StatusCode:    http.StatusOK,
+			Body:          io.NopCloser(strings.NewReader("12345")),
+			ContentLength: -1,
+			Header:        make(http.Header),
+			Request:       req,
+		}, nil
+	})}
+	t.Cleanup(func() { cloneHTTPClient = originalClient })
+
+	budget := int64(4)
+	target := t.TempDir() + "/download.txt"
+	if err := downloadFile(context.Background(), "https://raw.githubusercontent.com/example/repo/main/file", target, &budget); err == nil {
+		t.Fatal("expected download size error")
+	}
+	if _, statErr := os.Stat(target); !os.IsNotExist(statErr) {
+		t.Fatalf("partial download should be removed, stat error: %v", statErr)
+	}
+}
+
+func TestValidateDownloadURLRejectsUntrustedHostsAndCredentials(t *testing.T) {
+	for _, candidate := range []string{
+		"http://raw.githubusercontent.com/repo/file",
+		"https://example.com/repo/file",
+		"https://user@raw.githubusercontent.com/repo/file",
+	} {
+		if err := validateDownloadURL(candidate); err == nil {
+			t.Errorf("expected URL %q to be rejected", candidate)
+		}
+	}
+}
+
+func TestCloneGETUsesRequestContext(t *testing.T) {
+	originalClient := cloneHTTPClient
+	cloneHTTPClient = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		<-req.Context().Done()
+		return nil, req.Context().Err()
+	})}
+	t.Cleanup(func() { cloneHTTPClient = originalClient })
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, err := cloneGET(ctx, "https://api.github.com/test"); err == nil {
+		t.Fatal("expected canceled request error")
+	}
+}
diff --git a/internal/commands/create_feature.go b/internal/commands/create_feature.go
index 6057c5a..bd8b7a3 100644
--- a/internal/commands/create_feature.go
+++ b/internal/commands/create_feature.go
@@ -54,6 +54,9 @@ func runCreateFeature(cmd *cobra.Command, args []string, resourceName string) er
 
 	// Check if creating in a resource
 	if resourceName != "" {
+		if err := validateCreateName("resource")(resourceName); err != nil {
+			return err
+		}
 		// Verify resource exists
 		resourcePath := filepath.Join("resources", resourceName)
 		if _, err := os.Stat(resourcePath); os.IsNotExist(err) {
diff --git a/internal/commands/create_helpers.go b/internal/commands/create_helpers.go
index 4c1cedc..4db8570 100644
--- a/internal/commands/create_helpers.go
+++ b/internal/commands/create_helpers.go
@@ -19,11 +19,8 @@ type createNamePrompt struct {
 
 func validateCreateName(kind string) func(string) error {
 	return func(s string) error {
-		if s == "" {
-			return fmt.Errorf("%s name cannot be empty", kind)
-		}
-		if strings.Contains(s, " ") {
-			return fmt.Errorf("%s name cannot contain spaces", kind)
+		if err := templates.ValidateName(s); err != nil {
+			return fmt.Errorf("invalid %s name: %w", kind, err)
 		}
 		return nil
 	}
@@ -31,7 +28,11 @@ func validateCreateName(kind string) func(string) error {
 
 func getNameFromArgsOrPrompt(args []string, p createNamePrompt) (string, error) {
 	if len(args) > 0 {
-		return args[0], nil
+		name := args[0]
+		if err := validateCreateName(p.Kind)(name); err != nil {
+			return "", err
+		}
+		return name, nil
 	}
 
 	var name string
@@ -48,6 +49,9 @@ func getNameFromArgsOrPrompt(args []string, p createNamePrompt) (string, error)
 		return "", err
 	}
 
+	if err := validateCreateName(p.Kind)(name); err != nil {
+		return "", err
+	}
 	return name, nil
 }
 
diff --git a/internal/commands/create_helpers_test.go b/internal/commands/create_helpers_test.go
index c6abfdb..380fc23 100644
--- a/internal/commands/create_helpers_test.go
+++ b/internal/commands/create_helpers_test.go
@@ -7,6 +7,25 @@ import (
 	"testing"
 )
 
+func TestValidateCreateNameForArgumentsAndPrompts(t *testing.T) {
+	valid := []string{"chat", "chat-admin", "chat_admin", "x1"}
+	for _, name := range valid {
+		if err := validateCreateName("resource")(name); err != nil {
+			t.Errorf("expected %q to be valid: %v", name, err)
+		}
+	}
+
+	invalid := []string{"", "../chat", "chat/name", `chat\name`, "chat name", "Chat", "chat.json", "chat;rm", " chat"}
+	for _, name := range invalid {
+		if err := validateCreateName("resource")(name); err == nil {
+			t.Errorf("expected %q to be invalid", name)
+		}
+		if _, err := getNameFromArgsOrPrompt([]string{name}, createNamePrompt{Kind: "resource"}); err == nil {
+			t.Errorf("expected argument %q to be rejected", name)
+		}
+	}
+}
+
 func findNodeModulesRoot(t *testing.T) (string, bool) {
 	t.Helper()
 
diff --git a/internal/commands/create_manifest.go b/internal/commands/create_manifest.go
index ca0285e..d79223d 100644
--- a/internal/commands/create_manifest.go
+++ b/internal/commands/create_manifest.go
@@ -63,11 +63,6 @@ func runCreateManifest(resourceName, standaloneName string, core, force bool) er
 	}
 
 	manifestPath := filepath.Join(target.Path, ocManifestFileName)
-	if !force {
-		if _, err := os.Stat(manifestPath); err == nil {
-			return fmt.Errorf("%s already exists\n\nUse '--force' to overwrite it", manifestPath)
-		}
-	}
 
 	manifest := buildExampleManifest(target)
 	body, err := json.MarshalIndent(manifest, "", "  ")
@@ -76,7 +71,7 @@ func runCreateManifest(resourceName, standaloneName string, core, force bool) er
 	}
 	body = append(body, '\n')
 
-	if err := os.WriteFile(manifestPath, body, 0644); err != nil {
+	if err := writeManifestFile(manifestPath, body, force); err != nil {
 		return fmt.Errorf("failed to write %s: %w", ocManifestFileName, err)
 	}
 
@@ -91,6 +86,43 @@ func runCreateManifest(resourceName, standaloneName string, core, force bool) er
 	return nil
 }
 
+func writeManifestFile(manifestPath string, body []byte, force bool) error {
+	if !force {
+		file, err := os.OpenFile(manifestPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0644)
+		if err != nil {
+			if os.IsExist(err) {
+				return fmt.Errorf("%s already exists; use '--force' to overwrite it", manifestPath)
+			}
+			return err
+		}
+		if _, err := file.Write(body); err != nil {
+			_ = file.Close()
+			_ = os.Remove(manifestPath)
+			return err
+		}
+		return file.Close()
+	}
+
+	temp, err := os.CreateTemp(filepath.Dir(manifestPath), ".oc-manifest-*")
+	if err != nil {
+		return err
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath)
+	if _, err := temp.Write(body); err != nil {
+		_ = temp.Close()
+		return err
+	}
+	if err := temp.Chmod(0644); err != nil {
+		_ = temp.Close()
+		return err
+	}
+	if err := temp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tempPath, manifestPath)
+}
+
 func resolveManifestCreateTarget(resourceName, standaloneName string, core bool) (manifestCreateTarget, error) {
 	targets := 0
 	if strings.TrimSpace(resourceName) != "" {
@@ -108,7 +140,7 @@ func resolveManifestCreateTarget(resourceName, standaloneName string, core bool)
 	}
 
 	if strings.TrimSpace(resourceName) != "" {
-		name := strings.TrimSpace(resourceName)
+		name := resourceName
 		if err := validateCreateName("resource")(name); err != nil {
 			return manifestCreateTarget{}, err
 		}
@@ -120,7 +152,7 @@ func resolveManifestCreateTarget(resourceName, standaloneName string, core bool)
 	}
 
 	if strings.TrimSpace(standaloneName) != "" {
-		name := strings.TrimSpace(standaloneName)
+		name := standaloneName
 		if err := validateCreateName("standalone")(name); err != nil {
 			return manifestCreateTarget{}, err
 		}
diff --git a/internal/commands/create_manifest_test.go b/internal/commands/create_manifest_test.go
index 7f7ea45..2f9fd04 100644
--- a/internal/commands/create_manifest_test.go
+++ b/internal/commands/create_manifest_test.go
@@ -16,6 +16,14 @@ func TestResolveManifestCreateTargetRequiresExactlyOneSelector(t *testing.T) {
 	}
 }
 
+func TestResolveManifestCreateTargetRejectsTraversal(t *testing.T) {
+	for _, name := range []string{"../chat", "chat/name", `chat\name`, " chat "} {
+		if _, err := resolveManifestCreateTarget(name, "", false); err == nil {
+			t.Errorf("expected resource name %q to be rejected", name)
+		}
+	}
+}
+
 func TestRunCreateManifestResource(t *testing.T) {
 	tmpDir := t.TempDir()
 	wd, err := os.Getwd()
@@ -108,3 +116,36 @@ func TestRunCreateManifestCore(t *testing.T) {
 		t.Fatalf("did not expect core manifest requires, got %#v", manifest.Requires)
 	}
 }
+
+func TestRunCreateManifestDoesNotOverwriteWithoutForce(t *testing.T) {
+	tmpDir := t.TempDir()
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Chdir(wd)
+
+	target := filepath.Join(tmpDir, "resources", "chat")
+	if err := os.MkdirAll(target, 0755); err != nil {
+		t.Fatal(err)
+	}
+	manifestPath := filepath.Join(target, ocManifestFileName)
+	original := []byte("do not overwrite")
+	if err := os.WriteFile(manifestPath, original, 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chdir(tmpDir); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := runCreateManifest("chat", "", false, false); err == nil {
+		t.Fatal("expected existing manifest error")
+	}
+	body, err := os.ReadFile(manifestPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(body) != string(original) {
+		t.Fatalf("existing manifest was modified: %q", body)
+	}
+}
diff --git a/internal/commands/doctor.go b/internal/commands/doctor.go
index 46649be..9401377 100644
--- a/internal/commands/doctor.go
+++ b/internal/commands/doctor.go
@@ -80,6 +80,7 @@ func runDoctor(cmd *cobra.Command, args []string) error {
 			adapterCheck := checkAdapter(cfg)
 			adapterCheck.Required = true
 			checks = append(checks, adapterCheck)
+			checks = append(checks, checkTypegen(cfg))
 		}
 	}
 
@@ -255,6 +256,26 @@ func formatAdapterBinding(side string, binding *config.AdapterBinding) string {
 	return fmt.Sprintf("%s: %s [%s] (%s)", side, name, adapterRuntimeLabel(binding), status)
 }
 
+func checkTypegen(cfg *config.Config) CheckResult {
+	if !cfg.Build.TypegenEnabled() {
+		return CheckResult{
+			Name:    "Type generation",
+			Passed:  true,
+			Message: "disabled (build.typegen.enabled = false)",
+		}
+	}
+
+	mode := "enabled"
+	if cfg.Build.TypegenStrict() {
+		mode = "enabled (strict: unknown event names are compile errors)"
+		if !cfg.Build.TypecheckEnabled() {
+			mode += "; builds do not type-check, set build.typecheck to fail on them"
+		}
+	}
+
+	return CheckResult{Name: "Type generation", Passed: true, Message: mode}
+}
+
 func adapterRuntimeLabel(binding *config.AdapterBinding) string {
 	if binding == nil || binding.Runtime == nil || strings.TrimSpace(binding.Runtime.Runtime) == "" {
 		return "default"
diff --git a/internal/commands/init.go b/internal/commands/init.go
index 2c67989..7bc2a6f 100644
--- a/internal/commands/init.go
+++ b/internal/commands/init.go
@@ -57,11 +57,8 @@ func runInit(cmd *cobra.Command, args []string) error {
 			Description: "Name of your OpenCore server project (no spaces)",
 			Type:        ui.StepTypeInput,
 			Validate: func(s string) error {
-				if s == "" {
-					return fmt.Errorf("project name cannot be empty")
-				}
-				if strings.Contains(s, " ") {
-					return fmt.Errorf("project name cannot contain spaces")
+				if err := validateCreateName("project")(s); err != nil {
+					return err
 				}
 				projectDir := filepath.Join(baseDir, s)
 				if _, err := os.Stat(projectDir); !os.IsNotExist(err) {
@@ -133,6 +130,9 @@ func runInit(cmd *cobra.Command, args []string) error {
 		if projectName == "" {
 			return fmt.Errorf("project name is required in non-interactive mode")
 		}
+		if err := validateCreateName("project")(projectName); err != nil {
+			return err
+		}
 		useMinify := minifyFlag
 		adapter := strings.TrimSpace(strings.ToLower(adapterFlag))
 		if adapter == "" {
@@ -222,6 +222,9 @@ func runInit(cmd *cobra.Command, args []string) error {
 
 	// Extract values
 	projectName := result.GetStringValue("Project Name")
+	if err := validateCreateName("project")(projectName); err != nil {
+		return err
+	}
 	adapter := result.GetStringValue("Adapter")
 	useMinify := result.GetBoolValue("Minification")
 	packageManager := result.GetStringValue("Package Manager")
diff --git a/internal/commands/update.go b/internal/commands/update.go
index aa855bd..7acdbf7 100644
--- a/internal/commands/update.go
+++ b/internal/commands/update.go
@@ -3,70 +3,125 @@ package commands
 import (
 	"fmt"
 	"os"
+	"os/exec"
+	"strings"
 
 	"github.com/newcore-network/opencore-cli/internal/ui"
-	"github.com/newcore-network/opencore-cli/internal/updater"
 	"github.com/spf13/cobra"
 )
 
-func NewUpdateCommand() *cobra.Command {
-	var force bool
-	var channel string
+const (
+	packageManagerAuto = "auto"
+	channelStable      = "stable"
+	channelBeta        = "beta"
+)
 
-	cmd := &cobra.Command{
-		Use:   "update",
-		Short: "Update OpenCore CLI from a release channel",
-		Run: func(cmd *cobra.Command, args []string) {
-			version := cmd.Root().Version
-			if version == "" {
-				version = "0.0.0"
-			}
+var findPackageManager = exec.LookPath
 
-			channel = updater.NormalizeChannel(channel)
+var runPackageManager = func(name string, args []string) error {
+	cmd := exec.Command(name, args...)
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
 
-			if force {
-				fmt.Println(ui.Info(fmt.Sprintf("Checking for updates on the %s channel (forced)...", channel)))
-			} else {
-				fmt.Println(ui.Info(fmt.Sprintf("Checking for updates on the %s channel...", channel)))
-			}
+func packageManagerFromUserAgent(userAgent string) string {
+	name := strings.SplitN(strings.TrimSpace(userAgent), "/", 2)[0]
+	switch name {
+	case "npm", "pnpm", "yarn":
+		return name
+	default:
+		return ""
+	}
+}
 
-			info, err := updater.CheckForUpdate(version, force, channel)
-			if err != nil {
-				fmt.Println(ui.Error(fmt.Sprintf("Failed to check for updates: %v", err)))
-				return
-			}
+func resolvePackageManager(requested string) (string, error) {
+	requested = strings.ToLower(strings.TrimSpace(requested))
+	if requested == "" {
+		requested = packageManagerAuto
+	}
 
-			if !updater.NeedsUpdate(cmd.Root().Version, info.LatestVersion) {
-				fmt.Println(ui.Success(fmt.Sprintf("OpenCore CLI is already up to date on the %s channel (%s)", channel, cmd.Root().Version)))
-				return
-			}
+	if requested != packageManagerAuto {
+		if requested != "npm" && requested != "pnpm" && requested != "yarn" {
+			return "", fmt.Errorf("unsupported package manager %q; use npm, pnpm, yarn, or auto", requested)
+		}
+		if _, err := findPackageManager(requested); err != nil {
+			return "", fmt.Errorf("%s is not available on PATH", requested)
+		}
+		return requested, nil
+	}
 
-			fmt.Println(ui.Info(fmt.Sprintf("New %s release available: %s (current: %s)", channel, info.LatestVersion, cmd.Root().Version)))
-
-			if updater.IsNPMInstallation() {
-				fmt.Println(ui.Warning("It looks like you installed OpenCore CLI via NPM."))
-				fmt.Println(ui.Info("Please run the following command to update:"))
-				npmTarget := "@open-core/cli"
-				if channel != updater.ChannelStable {
-					npmTarget = fmt.Sprintf("@open-core/cli@%s", channel)
-				}
-				fmt.Println(ui.Info(fmt.Sprintf("  npm install -g %s", npmTarget)))
-				return
-			}
+	preferred := packageManagerFromUserAgent(os.Getenv("npm_config_user_agent"))
+	candidates := []string{"npm", "pnpm", "yarn"}
+	if preferred != "" {
+		candidates = append([]string{preferred}, candidates...)
+	}
+	for _, manager := range candidates {
+		if _, err := findPackageManager(manager); err == nil {
+			return manager, nil
+		}
+	}
 
-			fmt.Println(ui.Info("Updating..."))
-			err = updater.Update(info.LatestVersion)
+	return "", fmt.Errorf("could not find npm, pnpm, or yarn on PATH")
+}
+
+func updateArgs(packageManager, channel string) ([]string, error) {
+	channel = strings.ToLower(strings.TrimSpace(channel))
+	if channel == "" {
+		channel = channelStable
+	}
+
+	var tag string
+	switch channel {
+	case channelStable:
+		tag = "latest"
+	case channelBeta:
+		tag = "beta"
+	default:
+		return nil, fmt.Errorf("unsupported update channel %q; use stable or beta", channel)
+	}
+
+	packageSpec := "@open-core/cli@" + tag
+	switch packageManager {
+	case "npm":
+		return []string{"install", "--global", packageSpec}, nil
+	case "pnpm":
+		return []string{"add", "--global", packageSpec}, nil
+	case "yarn":
+		return []string{"global", "add", packageSpec}, nil
+	default:
+		return nil, fmt.Errorf("unsupported package manager %q", packageManager)
+	}
+}
+
+func NewUpdateCommand() *cobra.Command {
+	var channel string
+	var packageManager string
+
+	cmd := &cobra.Command{
+		Use:   "update",
+		Short: "Update OpenCore CLI with npm, pnpm, or Yarn",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			manager, err := resolvePackageManager(packageManager)
 			if err != nil {
-				fmt.Println(ui.Error(fmt.Sprintf("Failed to update: %v", err)))
-				os.Exit(1)
+				return err
+			}
+			args, err = updateArgs(manager, channel)
+			if err != nil {
+				return err
 			}
 
-			fmt.Println(ui.Success(fmt.Sprintf("Successfully updated to %s!", info.LatestVersion)))
+			fmt.Println(ui.Info(fmt.Sprintf("Updating OpenCore CLI with %s...", manager)))
+			if err := runPackageManager(manager, args); err != nil {
+				return fmt.Errorf("failed to update OpenCore CLI with %s: %w", manager, err)
+			}
+			return nil
 		},
 	}
 
-	cmd.Flags().BoolVarP(&force, "force", "f", false, "Force update check, ignoring cache")
-	cmd.Flags().StringVar(&channel, "channel", updater.GetConfiguredChannel(), "Update channel to use (stable|beta)")
-
+	cmd.Flags().StringVar(&channel, "channel", channelStable, "Release channel to install (stable|beta)")
+	cmd.Flags().StringVarP(&packageManager, "package-manager", "p", packageManagerAuto, "Package manager to use (auto|npm|pnpm|yarn)")
 	return cmd
 }
diff --git a/internal/commands/update_test.go b/internal/commands/update_test.go
new file mode 100644
index 0000000..148bb81
--- /dev/null
+++ b/internal/commands/update_test.go
@@ -0,0 +1,90 @@
+package commands
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestUpdateArgs(t *testing.T) {
+	tests := []struct {
+		manager string
+		channel string
+		want    []string
+	}{
+		{"npm", "stable", []string{"install", "--global", "@open-core/cli@latest"}},
+		{"pnpm", "beta", []string{"add", "--global", "@open-core/cli@beta"}},
+		{"yarn", "stable", []string{"global", "add", "@open-core/cli@latest"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.manager+"-"+tt.channel, func(t *testing.T) {
+			got, err := updateArgs(tt.manager, tt.channel)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(got) != len(tt.want) {
+				t.Fatalf("args = %v, want %v", got, tt.want)
+			}
+			for i := range got {
+				if got[i] != tt.want[i] {
+					t.Fatalf("args = %v, want %v", got, tt.want)
+				}
+			}
+		})
+	}
+}
+
+func TestPackageManagerFromUserAgent(t *testing.T) {
+	tests := map[string]string{
+		"npm/11.0.0 node/v24": "npm",
+		"pnpm/10.0.0 npm/?":   "pnpm",
+		"yarn/1.22.22 npm/?":  "yarn",
+		"unknown/1.0.0 npm/?": "",
+	}
+	for userAgent, want := range tests {
+		if got := packageManagerFromUserAgent(userAgent); got != want {
+			t.Fatalf("packageManagerFromUserAgent(%q) = %q, want %q", userAgent, got, want)
+		}
+	}
+}
+
+func TestUpdateCommandUsesSelectedPackageManager(t *testing.T) {
+	originalFind := findPackageManager
+	originalRun := runPackageManager
+	t.Cleanup(func() {
+		findPackageManager = originalFind
+		runPackageManager = originalRun
+	})
+
+	findPackageManager = func(name string) (string, error) { return name, nil }
+	var gotName string
+	var gotArgs []string
+	runPackageManager = func(name string, args []string) error {
+		gotName = name
+		gotArgs = args
+		return nil
+	}
+
+	cmd := NewUpdateCommand()
+	cmd.SetArgs([]string{"--package-manager", "pnpm", "--channel", "beta"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatal(err)
+	}
+
+	if gotName != "pnpm" {
+		t.Fatalf("manager = %q, want pnpm", gotName)
+	}
+	if len(gotArgs) != 3 || gotArgs[2] != "@open-core/cli@beta" {
+		t.Fatalf("args = %v", gotArgs)
+	}
+}
+
+func TestResolvePackageManagerRejectsUnavailableExplicitManager(t *testing.T) {
+	originalFind := findPackageManager
+	t.Cleanup(func() { findPackageManager = originalFind })
+	findPackageManager = func(string) (string, error) { return "", errors.New("not found") }
+
+	if _, err := resolvePackageManager("yarn"); err == nil {
+		t.Fatal("expected unavailable package manager error")
+	}
+}
diff --git a/internal/config/config.go b/internal/config/config.go
index c5a9536..78db413 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1,14 +1,19 @@
 package config
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 )
 
+const configProtocolMarker = "__OPENCORE_CONFIG_JSON__"
+
 type Config struct {
 	Name        string            `json:"name"`
 	OutDir      string            `json:"outDir"`
@@ -323,7 +328,7 @@ func (s *ResourceBuildSideConfig) UnmarshalJSON(data []byte) error {
 	}
 
 	var opts BuildSideConfig
-	if err := json.Unmarshal(data, &opts); err != nil {
+	if err := decodeStrictJSON(data, &opts); err != nil {
 		return err
 	}
 
@@ -350,6 +355,7 @@ type ViewsConfig struct {
 }
 
 type BuildSideConfig struct {
+	Enabled    *bool    `json:"-"`
 	Platform   string   `json:"platform,omitempty"`
 	Format     string   `json:"format,omitempty"`
 	Target     string   `json:"target,omitempty"`
@@ -358,6 +364,26 @@ type BuildSideConfig struct {
 	SourceMaps *bool    `json:"sourceMaps,omitempty"`
 }
 
+// UnmarshalJSON accepts the boolean shorthand used by resource/core build
+// sides while retaining the object fields consumed by the builder.
+func (s *BuildSideConfig) UnmarshalJSON(data []byte) error {
+	var enabled bool
+	if err := json.Unmarshal(data, &enabled); err == nil {
+		s.Enabled = &enabled
+		return nil
+	}
+
+	type plain BuildSideConfig
+	var value plain
+	if err := decodeStrictJSON(data, &value); err != nil {
+		return err
+	}
+	enabled = true
+	*s = BuildSideConfig(value)
+	s.Enabled = &enabled
+	return nil
+}
+
 type BuildConfig struct {
 	Minify               bool                           `json:"minify"`
 	SourceMaps           bool                           `json:"sourceMaps"`
@@ -372,6 +398,40 @@ type BuildConfig struct {
 	Client               *BuildSideConfig               `json:"client,omitempty"`
 	Environment          string                         `json:"environment,omitempty"`
 	Environments         map[string]EnvironmentOverride `json:"environments,omitempty"`
+	Typegen              *TypegenConfig                 `json:"typegen,omitempty"`
+	Typecheck            *bool                          `json:"typecheck,omitempty"`
+}
+
+// TypecheckEnabled reports whether builds type-check the project with `tsc --noEmit`.
+// Defaults to false, so upgrading the CLI never breaks a project that bundles today.
+func (b *BuildConfig) TypecheckEnabled() bool {
+	if b == nil || b.Typecheck == nil {
+		return false
+	}
+	return *b.Typecheck
+}
+
+// TypegenConfig controls generation of the per-resource `.opencore/opencore.gen.ts` files
+// that give end-to-end type safety to net events, RPCs and commands.
+type TypegenConfig struct {
+	Enabled *bool `json:"enabled,omitempty"`
+	Strict  *bool `json:"strict,omitempty"`
+}
+
+// TypegenEnabled reports whether type generation should run. Defaults to true.
+func (b *BuildConfig) TypegenEnabled() bool {
+	if b == nil || b.Typegen == nil || b.Typegen.Enabled == nil {
+		return true
+	}
+	return *b.Typegen.Enabled
+}
+
+// TypegenStrict reports whether generated files should opt into strict mode. Defaults to true.
+func (b *BuildConfig) TypegenStrict() bool {
+	if b == nil || b.Typegen == nil || b.Typegen.Strict == nil {
+		return true
+	}
+	return *b.Typegen.Strict
 }
 
 // EnvironmentOverride holds per-environment build overrides
@@ -413,6 +473,89 @@ func FindProjectRoot(startDir string) (string, error) {
 	return "", fmt.Errorf("opencore.config.ts not found in current directory or any parent directory")
 }
 
+func parseNodeVersion(version string) (int, int, int, error) {
+	version = strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(version), "v"))
+	version = strings.SplitN(version, "-", 2)[0]
+	parts := strings.Split(version, ".")
+	if len(parts) != 3 {
+		return 0, 0, 0, fmt.Errorf("invalid Node.js version %q", version)
+	}
+	values := [3]int{}
+	for i := range values {
+		value, err := strconv.Atoi(parts[i])
+		if err != nil || value < 0 {
+			return 0, 0, 0, fmt.Errorf("invalid Node.js version %q", version)
+		}
+		values[i] = value
+	}
+	return values[0], values[1], values[2], nil
+}
+
+func validateNodeVersion(version string) error {
+	major, minor, _, err := parseNodeVersion(version)
+	if err != nil {
+		return err
+	}
+	if major < 20 || major == 20 && minor < 19 {
+		return fmt.Errorf("Node.js >=20.19.0 is required (found %s)", strings.TrimSpace(version))
+	}
+	return nil
+}
+
+func checkNodeVersion() error {
+	if _, err := exec.LookPath("node"); err != nil {
+		return fmt.Errorf("Node.js is not installed; install Node.js >=20.19.0")
+	}
+	out, err := exec.Command("node", "--version").Output()
+	if err != nil {
+		return fmt.Errorf("failed to determine Node.js version: %w", err)
+	}
+	return validateNodeVersion(string(out))
+}
+
+func decodeStrictJSON(data []byte, value any) error {
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(value); err != nil {
+		return err
+	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		return fmt.Errorf("unexpected data after config JSON")
+	}
+	return nil
+}
+
+func configJSONFromOutput(stdout []byte) ([]byte, error) {
+	index := bytes.LastIndex(stdout, []byte(configProtocolMarker))
+	if index < 0 {
+		return nil, fmt.Errorf("config loader did not emit its result marker")
+	}
+	payload := bytes.TrimSpace(stdout[index+len(configProtocolMarker):])
+	if len(payload) == 0 {
+		return nil, fmt.Errorf("config loader emitted an empty result")
+	}
+	return payload, nil
+}
+
+func writeTempLoader(contents string) (string, error) {
+	tmp, err := os.CreateTemp("", "opencore-config-loader-*.cjs")
+	if err != nil {
+		return "", err
+	}
+	name := tmp.Name()
+	if _, err := tmp.WriteString(contents); err != nil {
+		tmp.Close()
+		os.Remove(name)
+		return "", err
+	}
+	if err := tmp.Close(); err != nil {
+		os.Remove(name)
+		return "", err
+	}
+	return name, nil
+}
+
 // LoadWithProjectRoot reads and transpiles opencore.config.ts to Config and returns the project root.
 func LoadWithProjectRoot() (*Config, string, error) {
 	wd, err := os.Getwd()
@@ -427,9 +570,8 @@ func LoadWithProjectRoot() (*Config, string, error) {
 
 	configPathAbs := filepath.Join(root, "opencore.config.ts")
 
-	// Check if Node.js is installed
-	if _, err := exec.LookPath("node"); err != nil {
-		return nil, "", fmt.Errorf("Node.js is not installed. Please install Node.js 18+ and try again")
+	if err := checkNodeVersion(); err != nil {
+		return nil, "", err
 	}
 
 	// Create temporary transpiler script
@@ -442,12 +584,23 @@ const { createRequire } = require('module');
 // Make sure module resolution happens from the project root (cwd).
 const requireFromProject = createRequire(process.cwd() + path.sep);
 
-function inspectAdapterBinding(binding, pkgName, entryPath) {
+function adapterKind(binding) {
+  const candidate = String(binding?.runtime?.runtime || binding?.name || '').toLowerCase();
+  for (const kind of ['fivem', 'redm', 'ragemp', 'node']) {
+    if (candidate.includes(kind)) return kind;
+  }
+  return '';
+}
+
+function inspectAdapterBinding(binding, side) {
   if (!binding) {
     return undefined;
   }
 
   const name = typeof binding.name === 'string' ? binding.name : '';
+  const kind = adapterKind(binding);
+  const pkgName = kind && kind !== 'node' ? '@open-core/' + kind + '-adapter' : undefined;
+  const entryPath = pkgName ? pkgName + '/' + side : undefined;
   const hasRegister = typeof binding.register === 'function';
   const issues = [];
 
@@ -503,6 +656,7 @@ async function loadConfig(configPath) {
     os.tmpdir(),
     'opencore-config-' + process.pid + '-' + Date.now() + '-' + Math.random().toString(16).slice(2) + '.cjs'
   );
+	fs.closeSync(fs.openSync(outfile, 'wx', 0o600));
 
   try {
     try {
@@ -515,7 +669,7 @@ async function loadConfig(configPath) {
       bundle: true,
       platform: 'node',
       format: 'cjs',
-      target: ['node18'],
+		target: ['node20.19'],
       absWorkingDir: process.cwd(),
       write: true,
       logLevel: 'silent',
@@ -534,11 +688,11 @@ async function loadConfig(configPath) {
   try {
     const configPath = path.resolve(process.argv[2]);
     const config = await loadConfig(configPath);
-    const serialized = {
+	const serialized = {
       ...config,
       adapter: {
-        server: inspectAdapterBinding(config?.adapter?.server, '@open-core/fivem-adapter', '@open-core/fivem-adapter/server'),
-        client: inspectAdapterBinding(config?.adapter?.client, '@open-core/fivem-adapter', '@open-core/fivem-adapter/client'),
+		server: inspectAdapterBinding(config?.adapter?.server, 'server'),
+		client: inspectAdapterBinding(config?.adapter?.client, 'client'),
       },
     };
 
@@ -546,7 +700,7 @@ async function loadConfig(configPath) {
       delete serialized.adapter;
     }
 
-    console.log(JSON.stringify(serialized, null, 2));
+	process.stdout.write('` + configProtocolMarker + `' + JSON.stringify(serialized));
   } catch (error) {
     console.error('Failed to load config:', error.message);
     process.exit(1);
@@ -554,9 +708,9 @@ async function loadConfig(configPath) {
 })();
 `
 
-	// Write transpiler script to temp file
-	tmpFile := filepath.Join(os.TempDir(), "opencore-config-loader.js")
-	if err := os.WriteFile(tmpFile, []byte(transpilerScript), 0644); err != nil {
+	// CreateTemp is unique and creates the loader with mode 0600.
+	tmpFile, err := writeTempLoader(transpilerScript)
+	if err != nil {
 		return nil, "", fmt.Errorf("failed to create transpiler script: %w", err)
 	}
 	defer os.Remove(tmpFile)
@@ -564,19 +718,24 @@ async function loadConfig(configPath) {
 	// Execute transpiler script
 	cmd := exec.Command("node", tmpFile, configPathAbs)
 	cmd.Dir = root
-	output, err := cmd.CombinedOutput()
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	err = cmd.Run()
 	if err != nil {
-		return nil, "", fmt.Errorf("failed to transpile config: %w\nOutput: %s", err, string(output))
+		return nil, "", fmt.Errorf("failed to transpile config: %w\nstderr: %s\nstdout: %s", err, strings.TrimSpace(stderr.String()), strings.TrimSpace(stdout.String()))
 	}
 
-	// Parse JSON output
+	payload, err := configJSONFromOutput(stdout.Bytes())
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to read config loader output: %w\nstderr: %s\nstdout: %s", err, strings.TrimSpace(stderr.String()), strings.TrimSpace(stdout.String()))
+	}
 	var config Config
-	if err := json.Unmarshal(output, &config); err != nil {
-		return nil, "", fmt.Errorf("failed to parse config JSON: %w\nOutput: %s", err, string(output))
+	if err := decodeStrictJSON(payload, &config); err != nil {
+		return nil, "", fmt.Errorf("failed to parse config JSON: %w", err)
 	}
-
-	if strings.TrimSpace(config.Name) == "" {
-		return nil, "", fmt.Errorf("config.name is required")
+	if err := normalizeAndValidate(&config); err != nil {
+		return nil, "", err
 	}
 
 	runtimeKind := config.RuntimeKind()
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index afcd776..6edff9f 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -2,6 +2,8 @@ package config
 
 import (
 	"encoding/json"
+	"os"
+	"strings"
 	"testing"
 )
 
@@ -262,6 +264,117 @@ func TestResourceBuildSideConfigUnmarshalBool(t *testing.T) {
 	}
 }
 
+func TestCoreBuildSidesAcceptBooleanAndObject(t *testing.T) {
+	var cfg Config
+	err := decodeStrictJSON([]byte(`{
+		"name":"project","core":{"path":"./core","resourceName":"core","build":{
+			"server":false,"client":{"target":"es2020"}
+		}}
+	}`), &cfg)
+	if err != nil {
+		t.Fatalf("failed to parse core build shorthand: %v", err)
+	}
+	if cfg.Core.Build == nil || cfg.Core.Build.Server == nil || cfg.Core.Build.Server.Enabled == nil || *cfg.Core.Build.Server.Enabled {
+		t.Fatalf("expected disabled core server build, got %#v", cfg.Core.Build)
+	}
+	if cfg.Core.Build.Client == nil || cfg.Core.Build.Client.Enabled == nil || !*cfg.Core.Build.Client.Enabled || cfg.Core.Build.Client.Target != "es2020" {
+		t.Fatalf("expected enabled core client object, got %#v", cfg.Core.Build.Client)
+	}
+}
+
+func TestDecodeStrictJSONRejectsUnknownProperties(t *testing.T) {
+	var cfg Config
+	err := decodeStrictJSON([]byte(`{"name":"project","core":{"path":"./core","resourceName":"core"},"build":{"server":{"targte":"node20"}}}`), &cfg)
+	if err == nil || !strings.Contains(err.Error(), "unknown field") {
+		t.Fatalf("expected unknown property error, got %v", err)
+	}
+}
+
+func TestConfigProtocolIgnoresConfigStdoutLogs(t *testing.T) {
+	payload, err := configJSONFromOutput([]byte("config says hello\n" + configProtocolMarker + `{"name":"project"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(payload) != `{"name":"project"}` {
+		t.Fatalf("unexpected payload %q", payload)
+	}
+}
+
+func TestWriteTempLoaderIsUniqueAndPrivate(t *testing.T) {
+	first, err := writeTempLoader("first")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(first)
+	second, err := writeTempLoader("second")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(second)
+	if first == second {
+		t.Fatalf("expected unique temp paths, got %q", first)
+	}
+	for _, path := range []string{first, second} {
+		info, err := os.Stat(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := info.Mode().Perm(); got != 0600 {
+			t.Errorf("expected %s permissions 0600, got %04o", path, got)
+		}
+	}
+}
+
+func TestValidateNodeVersion(t *testing.T) {
+	for _, version := range []string{"v20.19.0", "20.19.1", "v22.0.0"} {
+		if err := validateNodeVersion(version); err != nil {
+			t.Errorf("expected %s to be accepted: %v", version, err)
+		}
+	}
+	for _, version := range []string{"v18.20.0", "v20.18.9", "invalid"} {
+		if err := validateNodeVersion(version); err == nil {
+			t.Errorf("expected %s to be rejected", version)
+		}
+	}
+}
+
+func TestNormalizeAndValidate(t *testing.T) {
+	valid := Config{
+		Name:      " project ",
+		Core:      CoreConfig{Path: " ./core ", ResourceName: "core"},
+		Resources: ResourcesConfig{Include: []string{"./resources/*"}},
+		Build:     BuildConfig{MaxWorkers: 4, DependencyResolution: &DependencyResolutionConfig{Mode: "ISOLATED", PackageManager: "PNPM"}},
+	}
+	if err := normalizeAndValidate(&valid); err != nil {
+		t.Fatalf("expected valid config: %v", err)
+	}
+	if valid.Name != "project" || valid.Destination != "" {
+		t.Fatalf("expected normalized name and optional destination, got %#v", valid)
+	}
+
+	tests := []struct {
+		name string
+		edit func(*Config)
+	}{
+		{"unsafe name", func(c *Config) { c.Name = "../project" }},
+		{"escaping core path", func(c *Config) { c.Core.Path = "../core" }},
+		{"invalid glob", func(c *Config) { c.Resources.Include = []string{"["} }},
+		{"negative workers", func(c *Config) { c.Build.MaxWorkers = -1 }},
+		{"invalid package manager", func(c *Config) { c.Build.DependencyResolution.PackageManager = "bun" }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cfg := valid
+			resolution := *valid.Build.DependencyResolution
+			cfg.Build.DependencyResolution = &resolution
+			test.edit(&cfg)
+			if err := normalizeAndValidate(&cfg); err == nil {
+				t.Fatal("expected validation error")
+			}
+		})
+	}
+}
+
 func TestRuntimeKindRageMP(t *testing.T) {
 	cfg := &Config{
 		Adapter: &AdapterConfig{
@@ -554,3 +667,37 @@ func TestGetResourceViews(t *testing.T) {
 		t.Error("Expected nil views for resource without views config")
 	}
 }
+
+func TestTypecheckEnabled_DefaultsToFalse(t *testing.T) {
+	var nilBuild *BuildConfig
+	if nilBuild.TypecheckEnabled() || (&BuildConfig{}).TypecheckEnabled() {
+		t.Fatal("expected typecheck to be off by default")
+	}
+	enabled := true
+	if !(&BuildConfig{Typecheck: &enabled}).TypecheckEnabled() {
+		t.Fatal("expected an explicit true to enable typecheck")
+	}
+}
+
+func TestTypegenStrict_DefaultsToTrue(t *testing.T) {
+	var nilBuild *BuildConfig
+	if !nilBuild.TypegenStrict() || !(&BuildConfig{}).TypegenStrict() ||
+		!(&BuildConfig{Typegen: &TypegenConfig{}}).TypegenStrict() {
+		t.Fatal("expected strict mode to be on by default")
+	}
+	disabled := false
+	if (&BuildConfig{Typegen: &TypegenConfig{Strict: &disabled}}).TypegenStrict() {
+		t.Fatal("expected an explicit false to disable strict mode")
+	}
+}
+
+func TestTypegenStrict_DecodesExplicitFalse(t *testing.T) {
+	var cfg Config
+	err := decodeStrictJSON([]byte(`{"name":"project","core":{"path":"./core","resourceName":"core"},"build":{"typegen":{"strict":false}}}`), &cfg)
+	if err != nil {
+		t.Fatalf("decode failed: %v", err)
+	}
+	if cfg.Build.TypegenStrict() {
+		t.Fatal("expected strict: false in the config to disable strict mode")
+	}
+}
diff --git a/internal/config/validation.go b/internal/config/validation.go
new file mode 100644
index 0000000..22a1988
--- /dev/null
+++ b/internal/config/validation.go
@@ -0,0 +1,256 @@
+package config
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+	"unicode"
+)
+
+func normalizeAndValidate(config *Config) error {
+	config.Name = strings.TrimSpace(config.Name)
+	config.OutDir = strings.TrimSpace(config.OutDir)
+	config.Destination = strings.TrimSpace(config.Destination)
+	config.Core.Path = strings.TrimSpace(config.Core.Path)
+	config.Core.ResourceName = strings.TrimSpace(config.Core.ResourceName)
+	if strings.ContainsRune(config.OutDir, '\x00') || strings.ContainsRune(config.Destination, '\x00') {
+		return fmt.Errorf("config output paths must not contain a NUL byte")
+	}
+
+	if err := validateName("config.name", config.Name, true); err != nil {
+		return err
+	}
+	if err := validateSourcePath("config.core.path", config.Core.Path, true); err != nil {
+		return err
+	}
+	if err := validateName("config.core.resourceName", config.Core.ResourceName, true); err != nil {
+		return err
+	}
+	if err := validateBuild("config.build", &config.Build); err != nil {
+		return err
+	}
+	if config.Core.Build != nil {
+		if err := validateBuild("config.core.build", config.Core.Build); err != nil {
+			return err
+		}
+	}
+	if err := validateEntryPoints("config.core.entryPoints", config.Core.EntryPoints); err != nil {
+		return err
+	}
+	if err := validateOptionalSourcePath("config.core.customCompiler", config.Core.CustomCompiler); err != nil {
+		return err
+	}
+	if err := validateViews("config.core.views", config.Core.Views); err != nil {
+		return err
+	}
+	if err := validateCollection("config.resources", config.Resources.Include, config.Resources.Explicit, config.Resources.Views); err != nil {
+		return err
+	}
+	if config.Standalones != nil {
+		if err := validateCollection("config.standalones", config.Standalones.Include, config.Standalones.Explicit, config.Standalones.Views); err != nil {
+			return err
+		}
+	}
+	if err := validateAdapter(config.Adapter); err != nil {
+		return err
+	}
+	return validateDev(&config.Dev)
+}
+
+func validateCollection(field string, globs []string, resources []ExplicitResource, views *ViewsConfig) error {
+	if err := validateGlobs(field+".include", globs); err != nil {
+		return err
+	}
+	if err := validateViews(field+".views", views); err != nil {
+		return err
+	}
+	seen := make(map[string]struct{}, len(resources))
+	for i := range resources {
+		resource := &resources[i]
+		prefix := fmt.Sprintf("%s.explicit[%d]", field, i)
+		resource.Path = strings.TrimSpace(resource.Path)
+		resource.ResourceName = strings.TrimSpace(resource.ResourceName)
+		if err := validateSourcePath(prefix+".path", resource.Path, true); err != nil {
+			return err
+		}
+		key := normalizedConfigPath(resource.Path)
+		if _, exists := seen[key]; exists {
+			return fmt.Errorf("%s.path duplicates %q", prefix, resource.Path)
+		}
+		seen[key] = struct{}{}
+		if err := validateName(prefix+".resourceName", resource.ResourceName, false); err != nil {
+			return err
+		}
+		if err := validateEntryPoints(prefix+".entryPoints", resource.EntryPoints); err != nil {
+			return err
+		}
+		if err := validateOptionalSourcePath(prefix+".customCompiler", resource.CustomCompiler); err != nil {
+			return err
+		}
+		if err := validateViews(prefix+".views", resource.Views); err != nil {
+			return err
+		}
+		if resource.Build != nil {
+			if err := validateDependencyResolution(prefix+".build.dependencyResolution", resource.Build.DependencyResolution); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func validateName(field, value string, required bool) error {
+	if value == "" {
+		if required {
+			return fmt.Errorf("%s is required", field)
+		}
+		return nil
+	}
+	if value == "." || value == ".." || strings.ContainsAny(value, `/\\`) {
+		return fmt.Errorf("%s must be a name, not a path", field)
+	}
+	if strings.ContainsRune(value, '\x00') || strings.IndexFunc(value, unicode.IsControl) >= 0 {
+		return fmt.Errorf("%s contains invalid control characters", field)
+	}
+	return nil
+}
+
+func validateSourcePath(field, value string, required bool) error {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		if required {
+			return fmt.Errorf("%s is required", field)
+		}
+		return nil
+	}
+	if strings.ContainsRune(value, '\x00') {
+		return fmt.Errorf("%s contains a NUL byte", field)
+	}
+	path := filepath.FromSlash(value)
+	if filepath.IsAbs(path) {
+		return fmt.Errorf("%s must be relative to the project root", field)
+	}
+	clean := filepath.Clean(path)
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return fmt.Errorf("%s must not escape the project root", field)
+	}
+	return nil
+}
+
+func validateOptionalSourcePath(field, value string) error {
+	return validateSourcePath(field, value, false)
+}
+
+func validateGlobs(field string, patterns []string) error {
+	for i, pattern := range patterns {
+		pattern = strings.TrimSpace(pattern)
+		if pattern == "" {
+			return fmt.Errorf("%s[%d] must not be empty", field, i)
+		}
+		if _, err := filepath.Match(filepath.FromSlash(pattern), ""); err != nil {
+			return fmt.Errorf("%s[%d] is invalid: %w", field, i, err)
+		}
+		if err := validateSourcePath(fmt.Sprintf("%s[%d]", field, i), pattern, true); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateEntryPoints(field string, points *EntryPoints) error {
+	if points == nil {
+		return nil
+	}
+	if err := validateOptionalSourcePath(field+".server", points.Server); err != nil {
+		return err
+	}
+	return validateOptionalSourcePath(field+".client", points.Client)
+}
+
+func validateViews(field string, views *ViewsConfig) error {
+	if views == nil {
+		return nil
+	}
+	for name, value := range map[string]string{"path": views.Path, "entryPoint": views.EntryPoint, "outputDir": views.OutputDir} {
+		if err := validateOptionalSourcePath(field+"."+name, value); err != nil {
+			return err
+		}
+	}
+	if err := validateGlobs(field+".ignore", views.Ignore); err != nil {
+		return err
+	}
+	for i, name := range views.ForceInclude {
+		if err := validateOptionalSourcePath(fmt.Sprintf("%s.forceInclude[%d]", field, i), name); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateBuild(field string, build *BuildConfig) error {
+	if build.MaxWorkers < 0 {
+		return fmt.Errorf("%s.maxWorkers must not be negative", field)
+	}
+	return validateDependencyResolution(field+".dependencyResolution", build.DependencyResolution)
+}
+
+func validateDependencyResolution(field string, resolution *DependencyResolutionConfig) error {
+	if resolution == nil {
+		return nil
+	}
+	resolution.Mode = strings.ToLower(strings.TrimSpace(resolution.Mode))
+	resolution.PackageManager = strings.ToLower(strings.TrimSpace(resolution.PackageManager))
+	if resolution.Mode != "" && !oneOf(resolution.Mode, "auto", "isolated", "shared-resource", "bundle", "symlink") {
+		return fmt.Errorf("%s.mode must be auto, isolated, shared-resource, bundle, or symlink", field)
+	}
+	if resolution.PackageManager != "" && !oneOf(resolution.PackageManager, "auto", "npm", "pnpm", "yarn") {
+		return fmt.Errorf("%s.packageManager must be auto, npm, pnpm, or yarn", field)
+	}
+	if resolution.Mode == "shared-resource" {
+		if err := validateName(field+".sharedResourceName", strings.TrimSpace(resolution.SharedResourceName), true); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateAdapter(adapter *AdapterConfig) error {
+	if adapter == nil {
+		return nil
+	}
+	for side, binding := range map[string]*AdapterBinding{"server": adapter.Server, "client": adapter.Client} {
+		if binding == nil {
+			continue
+		}
+		if !binding.Valid {
+			return fmt.Errorf("config.adapter.%s is invalid: %s", side, strings.TrimSpace(binding.Message))
+		}
+		if strings.TrimSpace(binding.Name) == "" {
+			return fmt.Errorf("config.adapter.%s.name is required", side)
+		}
+	}
+	return nil
+}
+
+func validateDev(dev *DevConfig) error {
+	if dev.Bridge.Port < 0 || dev.Bridge.Port > 65535 || dev.Port < 0 || dev.Port > 65535 {
+		return fmt.Errorf("config.dev bridge port must be between 1 and 65535 when set")
+	}
+	mode := strings.ToLower(strings.TrimSpace(dev.Restart.Mode))
+	if mode != "" && !oneOf(mode, "auto", "process", "txadmin", "none") {
+		return fmt.Errorf("config.dev.restart.mode must be auto, process, txadmin, or none")
+	}
+	if dev.Process.StopTimeoutMs < 0 {
+		return fmt.Errorf("config.dev.process.stopTimeoutMs must not be negative")
+	}
+	return validateOptionalSourcePath("config.dev.process.cwd", dev.Process.Cwd)
+}
+
+func oneOf(value string, allowed ...string) bool {
+	for _, candidate := range allowed {
+		if value == candidate {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/pkgmgr/pkgmgr.go b/internal/pkgmgr/pkgmgr.go
index 709b0d9..0d6ae78 100644
--- a/internal/pkgmgr/pkgmgr.go
+++ b/internal/pkgmgr/pkgmgr.go
@@ -64,31 +64,46 @@ func PreferenceFromEnv() Choice {
 // PreferenceFromProject tries to infer the preferred package manager from the current project.
 // It does NOT validate if the binary exists.
 func PreferenceFromProject(projectRoot string) Choice {
+	choice, _ := PreferenceFromProjectStrict(projectRoot)
+	return choice
+}
+
+// PreferenceFromProjectStrict infers the project preference and reports a
+// malformed package.json or packageManager declaration instead of hiding it.
+func PreferenceFromProjectStrict(projectRoot string) (Choice, error) {
 	// 1) package.json "packageManager" field (highest priority)
 	if projectRoot == "" {
 		projectRoot = "."
 	}
-	if b, err := os.ReadFile(filepath.Join(projectRoot, "package.json")); err == nil {
+	packagePath := filepath.Join(projectRoot, "package.json")
+	if b, err := os.ReadFile(packagePath); err == nil {
 		var pkg packageJSON
-		if err := json.Unmarshal(b, &pkg); err == nil {
-			if c, ok := choiceFromPackageManagerField(pkg.PackageManager); ok {
-				return c
+		if err := json.Unmarshal(b, &pkg); err != nil {
+			return ChoiceAuto, fmt.Errorf("invalid %s: %w", packagePath, err)
+		}
+		if strings.TrimSpace(pkg.PackageManager) != "" {
+			if c, err := parsePackageManagerField(pkg.PackageManager); err == nil {
+				return c, nil
+			} else {
+				return ChoiceAuto, fmt.Errorf("invalid packageManager in %s: %w", packagePath, err)
 			}
 		}
+	} else if !os.IsNotExist(err) {
+		return ChoiceAuto, fmt.Errorf("failed to read %s: %w", packagePath, err)
 	}
 
 	// 2) Lockfiles
 	if fileExists(filepath.Join(projectRoot, "pnpm-lock.yaml")) {
-		return ChoicePnpm
+		return ChoicePnpm, nil
 	}
 	if fileExists(filepath.Join(projectRoot, "yarn.lock")) || fileExists(filepath.Join(projectRoot, ".yarnrc.yml")) {
-		return ChoiceYarn
+		return ChoiceYarn, nil
 	}
 	if fileExists(filepath.Join(projectRoot, "package-lock.json")) {
-		return ChoiceNpm
+		return ChoiceNpm, nil
 	}
 
-	return ChoiceAuto
+	return ChoiceAuto, nil
 }
 
 // EffectivePreference applies env override (if not auto) and otherwise falls back to project inference.
@@ -154,7 +169,7 @@ func (r Resolved) InstallCmd() string {
 	case ChoiceNpm:
 		return "npm install"
 	default:
-		return "npm install"
+		return ""
 	}
 }
 
@@ -168,7 +183,7 @@ func (r Resolved) AddDevCmd(pkgs ...string) string {
 	case ChoiceNpm:
 		return strings.TrimSpace("npm install -D " + args)
 	default:
-		return strings.TrimSpace("npm install -D " + args)
+		return ""
 	}
 }
 
@@ -182,7 +197,7 @@ func (r Resolved) AddCmd(pkgs ...string) string {
 	case ChoiceNpm:
 		return strings.TrimSpace("npm install " + args)
 	default:
-		return strings.TrimSpace("npm install " + args)
+		return ""
 	}
 }
 
@@ -199,7 +214,7 @@ func (r Resolved) ExecCmd(bin string, args ...string) string {
 	case ChoiceNpm:
 		return "npm exec -- " + bin + rest
 	default:
-		return "npm exec -- " + bin + rest
+		return ""
 	}
 }
 
@@ -246,22 +261,48 @@ func parseMajor(version string) (int, bool) {
 }
 
 func choiceFromPackageManagerField(field string) (Choice, bool) {
+	choice, err := parsePackageManagerField(field)
+	return choice, err == nil
+}
+
+func parsePackageManagerField(field string) (Choice, error) {
 	f := strings.TrimSpace(strings.ToLower(field))
-	if f == "" {
-		return "", false
+	parts := strings.SplitN(f, "@", 2)
+	if len(parts) != 2 || strings.TrimSpace(parts[1]) == "" {
+		return "", fmt.Errorf("expected <npm|pnpm|yarn>@<version>, got %q", field)
 	}
-	// examples: "pnpm@9.0.0", "yarn@4.0.0", "npm@10.0.0"
-	name := strings.SplitN(f, "@", 2)[0]
-	switch name {
-	case string(ChoicePnpm):
-		return ChoicePnpm, true
-	case string(ChoiceYarn):
-		return ChoiceYarn, true
-	case string(ChoiceNpm):
-		return ChoiceNpm, true
-	default:
-		return "", false
+	choice, err := ParseChoice(parts[0])
+	if err != nil || choice == ChoiceAuto {
+		return "", fmt.Errorf("unsupported package manager %q", parts[0])
+	}
+	if _, _, _, err := parseVersion(parts[1]); err != nil {
+		return "", err
+	}
+	if choice == ChoiceYarn {
+		major, _, _, _ := parseVersion(parts[1])
+		if major < 2 {
+			return "", fmt.Errorf("yarn v1 is not supported; use Yarn Berry (v2+)")
+		}
+	}
+	return choice, nil
+}
+
+func parseVersion(version string) (int, int, int, error) {
+	version = strings.SplitN(strings.TrimSpace(strings.TrimPrefix(version, "v")), "+", 2)[0]
+	version = strings.SplitN(version, "-", 2)[0]
+	parts := strings.Split(version, ".")
+	if len(parts) < 1 || len(parts) > 3 {
+		return 0, 0, 0, fmt.Errorf("invalid package manager version %q", version)
+	}
+	values := [3]int{}
+	for i, part := range parts {
+		value, err := strconv.Atoi(part)
+		if err != nil || value < 0 {
+			return 0, 0, 0, fmt.Errorf("invalid package manager version %q", version)
+		}
+		values[i] = value
 	}
+	return values[0], values[1], values[2], nil
 }
 
 func fileExists(p string) bool {
diff --git a/internal/pkgmgr/pkgmgr_test.go b/internal/pkgmgr/pkgmgr_test.go
new file mode 100644
index 0000000..a9bdf1a
--- /dev/null
+++ b/internal/pkgmgr/pkgmgr_test.go
@@ -0,0 +1,59 @@
+package pkgmgr
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestPreferenceFromProjectStrict(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "package.json"), []byte(`{"packageManager":"yarn@4.5.1"}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	choice, err := PreferenceFromProjectStrict(dir)
+	if err != nil || choice != ChoiceYarn {
+		t.Fatalf("expected Yarn Berry, got %q, %v", choice, err)
+	}
+}
+
+func TestPreferenceFromProjectStrictRejectsInvalidDeclarations(t *testing.T) {
+	for name, contents := range map[string]string{
+		"malformed json":      `{`,
+		"missing version":     `{"packageManager":"pnpm"}`,
+		"unsupported manager": `{"packageManager":"bun@1.0.0"}`,
+		"yarn classic":        `{"packageManager":"yarn@1.22.22"}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			if err := os.WriteFile(filepath.Join(dir, "package.json"), []byte(contents), 0600); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := PreferenceFromProjectStrict(dir); err == nil {
+				t.Fatal("expected an error")
+			}
+		})
+	}
+}
+
+func TestYarnBerryCommands(t *testing.T) {
+	resolved := Resolved{Choice: ChoiceYarn, Version: "4.5.1"}
+	tests := map[string]string{
+		resolved.InstallCmd():             "yarn install",
+		resolved.AddDevCmd("vitest"):      "yarn add -D vitest",
+		resolved.AddCmd("react"):          "yarn add react",
+		resolved.ExecCmd("vite", "build"): "yarn dlx vite build",
+	}
+	for got, want := range tests {
+		if got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+	}
+}
+
+func TestInvalidResolvedDoesNotFallBackToNpm(t *testing.T) {
+	resolved := Resolved{Choice: Choice("bun")}
+	if resolved.InstallCmd() != "" || resolved.AddCmd("pkg") != "" || resolved.ExecCmd("bin") != "" {
+		t.Fatal("invalid package manager must not silently run npm")
+	}
+}
diff --git a/internal/templates/embed.go b/internal/templates/embed.go
index 8854529..ac434a9 100644
--- a/internal/templates/embed.go
+++ b/internal/templates/embed.go
@@ -2,10 +2,12 @@ package templates
 
 import (
 	"embed"
+	"encoding/json"
 	"fmt"
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"text/template"
 )
@@ -16,6 +18,33 @@ import (
 //go:embed all:feature
 var templatesFS embed.FS
 
+var scaffoldNamePattern = regexp.MustCompile(`^[a-z0-9][a-z0-9_-]*$`)
+
+// ValidateName applies the single naming policy used by scaffold commands and manifests.
+func ValidateName(name string) error {
+	if !scaffoldNamePattern.MatchString(name) {
+		return fmt.Errorf("name must match %s", scaffoldNamePattern.String())
+	}
+	return nil
+}
+
+var templateFunctions = template.FuncMap{
+	"jsonString": func(value string) (string, error) {
+		encoded, err := json.Marshal(value)
+		return string(encoded), err
+	},
+	"luaString": func(value string) string {
+		replacer := strings.NewReplacer(
+			`\`, `\\`,
+			`'`, `\'`,
+			"\r", `\r`,
+			"\n", `\n`,
+			"\x00", `\0`,
+		)
+		return "'" + replacer.Replace(value) + "'"
+	},
+}
+
 type ProjectConfig struct {
 	ProjectName          string
 	InstallIdentity      bool
@@ -159,12 +188,9 @@ type FeatureConfig struct {
 }
 
 func GenerateStarterProject(targetPath, projectName string, installIdentity bool, adapter string, useMinify bool, destination string, packageManager string) error {
-	if destination != "" {
-		// Ensure the generated TypeScript config is safe on Windows.
-		// Backslashes can be interpreted as escape sequences in JS/TS strings.
-		destination = strings.ReplaceAll(destination, "\\", "/")
+	if err := ValidateName(projectName); err != nil {
+		return fmt.Errorf("invalid project name: %w", err)
 	}
-
 	installFiveMAdapter := adapter == "fivem"
 
 	config := ProjectConfig{
@@ -182,10 +208,19 @@ func GenerateStarterProject(targetPath, projectName string, installIdentity bool
 		config.ManifestGame = "rdr3"
 		config.AddRedMWarning = true
 	}
+	cleanup, err := createTargetDirectory(targetPath)
+	if err != nil {
+		return err
+	}
+	succeeded := false
+	defer func() {
+		if !succeeded {
+			cleanup()
+		}
+	}()
 
 	// Create base directories
 	dirs := []string{
-		targetPath,
 		filepath.Join(targetPath, "core"),
 		filepath.Join(targetPath, "core", "src"),
 		filepath.Join(targetPath, "core", "src", "features"),
@@ -224,36 +259,33 @@ func GenerateStarterProject(targetPath, projectName string, installIdentity bool
 	for tplFile, targetFile := range files {
 		// Use forward slashes for embed.FS (works on all platforms)
 		embedPath := path.Join("starter-project", tplFile)
-		content, err := templatesFS.ReadFile(embedPath)
-		if err != nil {
-			return fmt.Errorf("failed to read template %s: %w", tplFile, err)
-		}
-
-		tmpl, err := template.New(tplFile).Parse(string(content))
-		if err != nil {
-			return fmt.Errorf("failed to parse template %s: %w", tplFile, err)
-		}
-
-		f, err := os.Create(targetFile)
-		if err != nil {
-			return fmt.Errorf("failed to create file %s: %w", targetFile, err)
-		}
-		defer f.Close()
-
-		if err := tmpl.Execute(f, config); err != nil {
-			return fmt.Errorf("failed to execute template %s: %w", tplFile, err)
+		if err := renderTemplateFile(embedPath, tplFile, targetFile, config); err != nil {
+			return err
 		}
 	}
 
+	succeeded = true
 	return nil
 }
 
 func GenerateResource(targetPath, resourceName string, hasClient, hasNUI bool, opts ScaffoldRuntimeOptions) error {
+	if err := ValidateName(resourceName); err != nil {
+		return fmt.Errorf("invalid resource name: %w", err)
+	}
 	config := resourceTemplateConfig(resourceName, hasClient, hasNUI, opts)
+	cleanup, err := createTargetDirectory(targetPath)
+	if err != nil {
+		return err
+	}
+	succeeded := false
+	defer func() {
+		if !succeeded {
+			cleanup()
+		}
+	}()
 
 	// Create directories
 	dirs := []string{
-		targetPath,
 		filepath.Join(targetPath, "src"),
 		filepath.Join(targetPath, "src", "server"),
 	}
@@ -286,40 +318,41 @@ func GenerateResource(targetPath, resourceName string, hasClient, hasNUI bool, o
 		files["src/client/main.ts"] = filepath.Join(targetPath, "src", "client", "main.ts")
 	}
 
+	if hasNUI {
+		files["ui/tsconfig.json"] = filepath.Join(targetPath, "ui", "tsconfig.json")
+	}
+
 	for tplFile, targetFile := range files {
 		// Use forward slashes for embed.FS (works on all platforms)
 		embedPath := path.Join("resource", tplFile)
-		content, err := templatesFS.ReadFile(embedPath)
-		if err != nil {
-			return fmt.Errorf("failed to read template %s: %w", tplFile, err)
-		}
-
-		tmpl, err := template.New(tplFile).Parse(string(content))
-		if err != nil {
-			return fmt.Errorf("failed to parse template %s: %w", tplFile, err)
-		}
-
-		f, err := os.Create(targetFile)
-		if err != nil {
-			return fmt.Errorf("failed to create file %s: %w", targetFile, err)
-		}
-		defer f.Close()
-
-		if err := tmpl.Execute(f, config); err != nil {
-			return fmt.Errorf("failed to execute template %s: %w", tplFile, err)
+		if err := renderTemplateFile(embedPath, tplFile, targetFile, config); err != nil {
+			return err
 		}
 	}
 
+	succeeded = true
 	return nil
 }
 
 // GenerateStandalone generates a new standalone resource from templates.
 func GenerateStandalone(targetPath, standaloneName string, hasClient, hasNUI bool, opts ScaffoldRuntimeOptions) error {
+	if err := ValidateName(standaloneName); err != nil {
+		return fmt.Errorf("invalid standalone name: %w", err)
+	}
 	config := standaloneTemplateConfig(standaloneName, hasClient, hasNUI, opts)
+	cleanup, err := createTargetDirectory(targetPath)
+	if err != nil {
+		return err
+	}
+	succeeded := false
+	defer func() {
+		if !succeeded {
+			cleanup()
+		}
+	}()
 
 	// Create directories
 	dirs := []string{
-		targetPath,
 		filepath.Join(targetPath, "src"),
 		filepath.Join(targetPath, "src", "server"),
 	}
@@ -354,41 +387,35 @@ func GenerateStandalone(targetPath, standaloneName string, hasClient, hasNUI boo
 
 	for tplFile, targetFile := range files {
 		embedPath := path.Join("standalone", tplFile)
-		content, err := templatesFS.ReadFile(embedPath)
-		if err != nil {
-			return fmt.Errorf("failed to read template %s: %w", tplFile, err)
-		}
-
-		tmpl, err := template.New(tplFile).Parse(string(content))
-		if err != nil {
-			return fmt.Errorf("failed to parse template %s: %w", tplFile, err)
-		}
-
-		f, err := os.Create(targetFile)
-		if err != nil {
-			return fmt.Errorf("failed to create file %s: %w", targetFile, err)
-		}
-		defer f.Close()
-
-		if err := tmpl.Execute(f, config); err != nil {
-			return fmt.Errorf("failed to execute template %s: %w", tplFile, err)
+		if err := renderTemplateFile(embedPath, tplFile, targetFile, config); err != nil {
+			return err
 		}
 	}
 
+	succeeded = true
 	return nil
 }
 
 func GenerateFeature(targetPath, featureName string) error {
+	if err := ValidateName(featureName); err != nil {
+		return fmt.Errorf("invalid feature name: %w", err)
+	}
 	pascalCase := toPascalCase(featureName)
 	config := FeatureConfig{
 		FeatureName:       featureName,
 		FeatureNamePascal: pascalCase,
 	}
 
-	// Create feature directory
-	if err := os.MkdirAll(targetPath, 0755); err != nil {
+	cleanup, err := createTargetDirectory(targetPath)
+	if err != nil {
 		return err
 	}
+	succeeded := false
+	defer func() {
+		if !succeeded {
+			cleanup()
+		}
+	}()
 
 	// Generate files
 	files := map[string]string{
@@ -400,27 +427,53 @@ func GenerateFeature(targetPath, featureName string) error {
 	for tplFile, targetFile := range files {
 		// Use forward slashes for embed.FS (works on all platforms)
 		embedPath := path.Join("feature", tplFile)
-		content, err := templatesFS.ReadFile(embedPath)
-		if err != nil {
-			return fmt.Errorf("failed to read template %s: %w", tplFile, err)
-		}
-
-		tmpl, err := template.New(tplFile).Parse(string(content))
-		if err != nil {
-			return fmt.Errorf("failed to parse template %s: %w", tplFile, err)
+		if err := renderTemplateFile(embedPath, tplFile, targetFile, config); err != nil {
+			return err
 		}
+	}
 
-		f, err := os.Create(targetFile)
-		if err != nil {
-			return fmt.Errorf("failed to create file %s: %w", targetFile, err)
-		}
-		defer f.Close()
+	succeeded = true
+	return nil
+}
 
-		if err := tmpl.Execute(f, config); err != nil {
-			return fmt.Errorf("failed to execute template %s: %w", tplFile, err)
+func createTargetDirectory(targetPath string) (func(), error) {
+	cleanTarget := filepath.Clean(targetPath)
+	if cleanTarget == "." {
+		return nil, fmt.Errorf("refusing to generate into the current directory")
+	}
+	if err := os.MkdirAll(filepath.Dir(cleanTarget), 0755); err != nil {
+		return nil, fmt.Errorf("failed to create parent directory: %w", err)
+	}
+	if err := os.Mkdir(cleanTarget, 0755); err != nil {
+		if os.IsExist(err) {
+			return nil, fmt.Errorf("target path %q already exists", cleanTarget)
 		}
+		return nil, fmt.Errorf("failed to create target directory: %w", err)
 	}
+	return func() { _ = os.RemoveAll(cleanTarget) }, nil
+}
 
+func renderTemplateFile(embedPath, templateName, targetFile string, data any) error {
+	content, err := templatesFS.ReadFile(embedPath)
+	if err != nil {
+		return fmt.Errorf("failed to read template %s: %w", templateName, err)
+	}
+	tmpl, err := template.New(templateName).Funcs(templateFunctions).Parse(string(content))
+	if err != nil {
+		return fmt.Errorf("failed to parse template %s: %w", templateName, err)
+	}
+	f, err := os.OpenFile(targetFile, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0644)
+	if err != nil {
+		return fmt.Errorf("failed to create file %s: %w", targetFile, err)
+	}
+	if err := tmpl.Execute(f, data); err != nil {
+		_ = f.Close()
+		_ = os.Remove(targetFile)
+		return fmt.Errorf("failed to execute template %s: %w", templateName, err)
+	}
+	if err := f.Close(); err != nil {
+		return fmt.Errorf("failed to close file %s: %w", targetFile, err)
+	}
 	return nil
 }
 
diff --git a/internal/templates/embed_test.go b/internal/templates/embed_test.go
index 51ee82d..c325f8f 100644
--- a/internal/templates/embed_test.go
+++ b/internal/templates/embed_test.go
@@ -1,12 +1,78 @@
 package templates
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 
+func TestValidateName(t *testing.T) {
+	for _, name := range []string{"chat", "chat-admin", "chat_admin", "x1"} {
+		if err := ValidateName(name); err != nil {
+			t.Errorf("expected %q to be valid: %v", name, err)
+		}
+	}
+	for _, name := range []string{"", "Chat", "../chat", "chat/name", `chat\name`, "chat.name", "chat name", "chat:admin"} {
+		if err := ValidateName(name); err == nil {
+			t.Errorf("expected %q to be invalid", name)
+		}
+	}
+}
+
+func TestGenerateStarterProjectEscapesGeneratedValues(t *testing.T) {
+	targetPath := filepath.Join(t.TempDir(), "safe-project")
+	destination := "C:\\server\\'resources\nnext"
+	packageManager := "pnpm\"@10"
+	if err := GenerateStarterProject(targetPath, "safe-project", false, "fivem", false, destination, packageManager); err != nil {
+		t.Fatalf("GenerateStarterProject() error = %v", err)
+	}
+
+	packageBody, err := os.ReadFile(filepath.Join(targetPath, "package.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var packageData map[string]any
+	if err := json.Unmarshal(packageBody, &packageData); err != nil {
+		t.Fatalf("generated package.json is invalid: %v", err)
+	}
+	if packageData["packageManager"] != packageManager {
+		t.Fatalf("package manager was not preserved, got %#v", packageData["packageManager"])
+	}
+
+	configBody, err := os.ReadFile(filepath.Join(targetPath, "opencore.config.ts"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(configBody), "destination: 'C:\\server\\'resources") {
+		t.Fatal("destination was emitted as an injectable single-quoted literal")
+	}
+	if !strings.Contains(string(configBody), `destination: "C:\\server\\'resources\nnext"`) {
+		t.Fatalf("destination was not JSON-escaped in TypeScript: %s", configBody)
+	}
+}
+
+func TestGenerateResourceDoesNotOverwriteExistingDirectory(t *testing.T) {
+	targetPath := filepath.Join(t.TempDir(), "existing")
+	if err := os.Mkdir(targetPath, 0755); err != nil {
+		t.Fatal(err)
+	}
+	markerPath := filepath.Join(targetPath, "marker.txt")
+	if err := os.WriteFile(markerPath, []byte("preserve"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	err := GenerateResource(targetPath, "existing", false, false, ScaffoldRuntimeOptions{})
+	if err == nil {
+		t.Fatal("expected existing target error")
+	}
+	body, readErr := os.ReadFile(markerPath)
+	if readErr != nil || string(body) != "preserve" {
+		t.Fatalf("existing directory was modified: body=%q err=%v", body, readErr)
+	}
+}
+
 func TestGenerateStarterProjectWithFiveMAdapter(t *testing.T) {
 	targetPath := filepath.Join(t.TempDir(), "demo-project")
 
diff --git a/internal/templates/resource/fxmanifest.lua b/internal/templates/resource/fxmanifest.lua
index a31e2eb..8e989e7 100644
--- a/internal/templates/resource/fxmanifest.lua
+++ b/internal/templates/resource/fxmanifest.lua
@@ -1,10 +1,10 @@
 fx_version 'cerulean'
-game '{{.ManifestGame}}'
+game {{luaString .ManifestGame}}
 {{if .AddRedMWarning}}
 rdr3_warning 'I acknowledge that this is a prerelease build of RedM, and I am aware my resources *will* become incompatible once RedM ships.'
 {{end}}
 
-name '{{.ResourceName}}'
+name {{luaString .ResourceName}}
 author 'Your Name'
 version '1.0.0'
 node_version '22'
@@ -28,4 +28,3 @@ files {
 dependencies {
     'core'
 }
-
diff --git a/internal/templates/resource/package.json b/internal/templates/resource/package.json
index c59532c..634a2b3 100644
--- a/internal/templates/resource/package.json
+++ b/internal/templates/resource/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "{{.ResourceName}}",
+  "name": {{jsonString .ResourceName}},
   "version": "1.0.0",
   "private": true,
   "main": "dist/server/main.js",
@@ -11,7 +11,7 @@
     "@open-core/framework": "latest"
   },
   "devDependencies": {
-    "typescript": "^5.3.3"{{if .UseCitizenFXTypes}},
+    "typescript": "^7.0.2"{{if .UseCitizenFXTypes}},
     "@citizenfx/server": "latest",
     "@citizenfx/client": "latest"{{end}}{{if .UseNodeTypes}},
     "@types/node": "^14.18.63",
diff --git a/internal/templates/resource/ui/tsconfig.json b/internal/templates/resource/ui/tsconfig.json
new file mode 100644
index 0000000..e51423d
--- /dev/null
+++ b/internal/templates/resource/ui/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "{{.TSConfigTarget}}",
+    "module": "{{.TSConfigModule}}",
+    "moduleResolution": "{{.TSModuleResolution}}",
+    "lib": ["es2020", "dom", "dom.iterable"],
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "types": [],
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "useDefineForClassFields": false
+  },
+  "include": [
+    "**/*",
+    "**/.opencore/**/*.ts"
+  ],
+  "exclude": ["dist", "node_modules"]
+}
diff --git a/internal/templates/standalone/fxmanifest.lua b/internal/templates/standalone/fxmanifest.lua
index 87330bc..801b35c 100644
--- a/internal/templates/standalone/fxmanifest.lua
+++ b/internal/templates/standalone/fxmanifest.lua
@@ -1,10 +1,10 @@
 fx_version 'cerulean'
-game '{{.ManifestGame}}'
+game {{luaString .ManifestGame}}
 {{if .AddRedMWarning}}
 rdr3_warning 'I acknowledge that this is a prerelease build of RedM, and I am aware my resources *will* become incompatible once RedM ships.'
 {{end}}
 
-name '{{.StandaloneName}}'
+name {{luaString .StandaloneName}}
 author 'Your Name'
 version '1.0.0'
 node_version '22'
diff --git a/internal/templates/standalone/package.json b/internal/templates/standalone/package.json
index e89e79f..2e6c6de 100644
--- a/internal/templates/standalone/package.json
+++ b/internal/templates/standalone/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "{{.StandaloneName}}",
+  "name": {{jsonString .StandaloneName}},
   "version": "1.0.0",
   "private": true,
   "scripts": {
@@ -10,7 +10,7 @@
     "@open-core/framework": "latest"
   },
   "devDependencies": {
-    "typescript": "^5.3.3"{{if .UseCitizenFXTypes}},
+    "typescript": "^7.0.2"{{if .UseCitizenFXTypes}},
     "@citizenfx/server": "latest",
     "@citizenfx/client": "latest"{{end}}{{if .UseNodeTypes}},
     "@types/node": "^14.18.63",
diff --git a/internal/templates/standalone/ui/tsconfig.json b/internal/templates/standalone/ui/tsconfig.json
new file mode 100644
index 0000000..e51423d
--- /dev/null
+++ b/internal/templates/standalone/ui/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "{{.TSConfigTarget}}",
+    "module": "{{.TSConfigModule}}",
+    "moduleResolution": "{{.TSModuleResolution}}",
+    "lib": ["es2020", "dom", "dom.iterable"],
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "types": [],
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "useDefineForClassFields": false
+  },
+  "include": [
+    "**/*",
+    "**/.opencore/**/*.ts"
+  ],
+  "exclude": ["dist", "node_modules"]
+}
diff --git a/internal/templates/starter-project/core/fxmanifest.lua b/internal/templates/starter-project/core/fxmanifest.lua
index 6dbb211..f93f661 100644
--- a/internal/templates/starter-project/core/fxmanifest.lua
+++ b/internal/templates/starter-project/core/fxmanifest.lua
@@ -1,10 +1,10 @@
 fx_version 'cerulean'
-game '{{.ManifestGame}}'
+game {{luaString .ManifestGame}}
 {{if .AddRedMWarning}}
 rdr3_warning 'I acknowledge that this is a prerelease build of RedM, and I am aware my resources *will* become incompatible once RedM ships.'
 {{end}}
 
-name '{{.ProjectName}}-core'
+name {{luaString (printf "%s-core" .ProjectName)}}
 description 'OpenCore server core'
 author 'Your Name'
 version '1.0.0'
@@ -18,4 +18,3 @@ client_scripts {
     'client.js'
 }
 
-
diff --git a/internal/templates/starter-project/core/package.json b/internal/templates/starter-project/core/package.json
index 16be79f..abff546 100644
--- a/internal/templates/starter-project/core/package.json
+++ b/internal/templates/starter-project/core/package.json
@@ -1,7 +1,6 @@
 {
-  "name": "{{.ProjectName}}-core",
+  "name": {{jsonString (printf "%s-core" .ProjectName)}},
   "version": "1.0.0",
   "private": true,
   "main": "dist/server.js"
 }
-
diff --git a/internal/templates/starter-project/opencore.config.ts b/internal/templates/starter-project/opencore.config.ts
index 6357258..deec34e 100644
--- a/internal/templates/starter-project/opencore.config.ts
+++ b/internal/templates/starter-project/opencore.config.ts
@@ -7,14 +7,14 @@ import { RageMPServerAdapter } from '@open-core/ragemp-adapter/server'
 // If you get a missing packages error, install dependencies in the project root.
 
 export default defineConfig({
-  name: '{{.ProjectName}}',
+  name: {{jsonString .ProjectName}},
 
 {{ if .InstallRageMPAdapter }}  // Mandatory: deploy to your RageMP server root.
   // OpenCore will place server files under packages/ and client files under client_packages/.
 {{ else }}  // Mandatory: Deploy to FiveM server
   // Here you must add the path where your FiveM resources are located.
 {{ end }}
-  destination: '{{.Destination}}',
+  destination: {{jsonString .Destination}},
 
 {{ if .InstallFiveMAdapter }}  adapter: {
     server: FiveMServerAdapter(),
@@ -53,7 +53,12 @@ export default defineConfig({
     },
     client: {
       target: 'es2020',
-    }{{ end }}
+    }{{ end }},
+    typecheck: true, // `opencore build` fails on type errors; `opencore dev` only warns
+    typegen: {
+      enabled: true,
+      strict: true, // unknown event/RPC/WebView names are compile errors; false accepts them
+    },
   },
 
   dev: {
diff --git a/internal/templates/starter-project/package.json b/internal/templates/starter-project/package.json
index 55721fe..1c4b89a 100644
--- a/internal/templates/starter-project/package.json
+++ b/internal/templates/starter-project/package.json
@@ -1,9 +1,9 @@
 {
-  "name": "{{.ProjectName}}",
+  "name": {{jsonString .ProjectName}},
   "version": "1.0.0",
   "private": true,
   "description": "OpenCore server project",
-  "packageManager": "{{.PackageManager}}",
+  "packageManager": {{jsonString .PackageManager}},
   "workspaces": [
     "core",
     "core/*/nui",
@@ -21,7 +21,7 @@
   "devDependencies": {
     "@open-core/cli": "latest",
     "vite": "^7.1.0",
-    "typescript": "^5.3.3",
+    "typescript": "^7.0.2",
     "esbuild": "^0.27.4",
     "@swc/core": "^1.15.7",
     "tsconfig-paths": "^4.2.0"{{if .InstallRageMPAdapter}},
diff --git a/internal/templates/starter-project/tsconfig.json b/internal/templates/starter-project/tsconfig.json
index e22ed83..b40f00a 100644
--- a/internal/templates/starter-project/tsconfig.json
+++ b/internal/templates/starter-project/tsconfig.json
@@ -10,7 +10,7 @@
 {{ end }}
         "skipLibCheck": true,
         "strict": true,
-        "baseUrl": ".",
+        "rootDir": ".",
         "paths": {
             "@opencore/environment": ["./environments/environment.development.ts"]
         },
@@ -24,8 +24,14 @@
 {{ else }}        "types": ["@citizenfx/client", "@citizenfx/server"]
 {{ end }}
     },
+    "include": [
+        "**/*",
+        "**/.opencore/**/*.ts"
+    ],
     "exclude": [
         "views",
+        "resources/*/ui",
+        "resources/*/nui",
         "dist",
         "node_modules"
     ]
diff --git a/internal/updater/updater.go b/internal/updater/updater.go
deleted file mode 100644
index e083a7d..0000000
--- a/internal/updater/updater.go
+++ /dev/null
@@ -1,229 +0,0 @@
-package updater
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/blang/semver/v4"
-	"github.com/minio/selfupdate"
-)
-
-const (
-	githubOwner = "newcore-network"
-	githubRepo  = "opencore-cli"
-)
-
-var (
-	updateCheckClient = &http.Client{Timeout: 1500 * time.Millisecond}
-	updateClient      = &http.Client{Timeout: 30 * time.Second}
-)
-
-type Release struct {
-	TagName    string  `json:"tag_name"`
-	Prerelease bool    `json:"prerelease"`
-	Draft      bool    `json:"draft"`
-	Assets     []Asset `json:"assets"`
-}
-
-type Asset struct {
-	Name               string `json:"name"`
-	BrowserDownloadURL string `json:"browser_download_url"`
-}
-
-type UpdateInfo struct {
-	Channel       string    `json:"channel"`
-	LatestVersion string    `json:"latest_version"`
-	LastCheck     time.Time `json:"last_check"`
-}
-
-const (
-	ChannelStable = "stable"
-	ChannelBeta   = "beta"
-)
-
-// CheckForUpdate checks if a new version is available on GitHub
-func CheckForUpdate(currentVersion string, force bool, channel string) (*UpdateInfo, error) {
-	channel = NormalizeChannel(channel)
-	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/releases", githubOwner, githubRepo)
-	resp, err := updateCheckClient.Get(url)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("failed to fetch releases: %s", resp.Status)
-	}
-
-	var releases []Release
-	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
-		return nil, err
-	}
-
-	release, err := selectReleaseForChannel(releases, channel)
-	if err != nil {
-		return nil, err
-	}
-
-	info := &UpdateInfo{
-		Channel:       channel,
-		LatestVersion: release.TagName,
-		LastCheck:     time.Now(),
-	}
-
-	return info, nil
-}
-
-func NormalizeChannel(channel string) string {
-	switch strings.ToLower(strings.TrimSpace(channel)) {
-	case "", ChannelStable:
-		return ChannelStable
-	case ChannelBeta:
-		return ChannelBeta
-	default:
-		return ChannelStable
-	}
-}
-
-func GetConfiguredChannel() string {
-	return NormalizeChannel(os.Getenv("OPENCORE_UPDATE_CHANNEL"))
-}
-
-func selectReleaseForChannel(releases []Release, channel string) (*Release, error) {
-	channel = NormalizeChannel(channel)
-
-	var best *Release
-	var bestVersion semver.Version
-
-	for i := range releases {
-		release := &releases[i]
-		if !releaseAllowedForChannel(*release, channel) {
-			continue
-		}
-
-		version, err := semver.ParseTolerant(release.TagName)
-		if err != nil {
-			continue
-		}
-
-		if best == nil || version.GT(bestVersion) {
-			best = release
-			bestVersion = version
-		}
-	}
-
-	if best == nil {
-		return nil, fmt.Errorf("no releases found for %s channel", channel)
-	}
-
-	return best, nil
-}
-
-func releaseAllowedForChannel(release Release, channel string) bool {
-	if release.Draft {
-		return false
-	}
-
-	tag := strings.ToLower(release.TagName)
-	channel = NormalizeChannel(channel)
-
-	switch channel {
-	case ChannelBeta:
-		if !release.Prerelease {
-			return true
-		}
-		return strings.Contains(tag, "beta")
-	default:
-		return !release.Prerelease
-	}
-}
-
-// NeedsUpdate compares current version with latest version
-func NeedsUpdate(currentVersion, latestVersion string) bool {
-	cv, err := semver.ParseTolerant(currentVersion)
-	if err != nil {
-		return false
-	}
-	lv, err := semver.ParseTolerant(latestVersion)
-	if err != nil {
-		return false
-	}
-	return lv.GT(cv)
-}
-
-// Update performs the self-update
-func Update(version string) error {
-	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/tags/%s", githubOwner, githubRepo, version)
-	resp, err := updateClient.Get(url)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	var release Release
-	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
-		return err
-	}
-
-	platform := getPlatform()
-	var downloadURL string
-	for _, asset := range release.Assets {
-		if asset.Name == fmt.Sprintf("opencore-%s%s", platform, getExt()) {
-			downloadURL = asset.BrowserDownloadURL
-			break
-		}
-	}
-
-	if downloadURL == "" {
-		return fmt.Errorf("could not find binary for platform %s", platform)
-	}
-
-	resp, err = updateClient.Get(downloadURL)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("failed to download binary: %s", resp.Status)
-	}
-
-	err = selfupdate.Apply(resp.Body, selfupdate.Options{})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func getPlatform() string {
-	arch := runtime.GOARCH
-	if arch == "amd64" {
-		arch = "amd64"
-	}
-	return fmt.Sprintf("%s-%s", runtime.GOOS, arch)
-}
-
-func getExt() string {
-	if runtime.GOOS == "windows" {
-		return ".exe"
-	}
-	return ""
-}
-
-// IsNPMInstallation checks if the CLI was likely installed via NPM
-func IsNPMInstallation() bool {
-	executable, err := os.Executable()
-	if err != nil {
-		return false
-	}
-	// Check if the executable is inside an 'npm' or 'node_modules' directory
-	return filepath.Base(filepath.Dir(filepath.Dir(executable))) == "npm" ||
-		filepath.Base(filepath.Dir(filepath.Dir(filepath.Dir(executable)))) == "node_modules"
-}
diff --git a/internal/updater/updater_test.go b/internal/updater/updater_test.go
deleted file mode 100644
index 59b4798..0000000
--- a/internal/updater/updater_test.go
+++ /dev/null
@@ -1,76 +0,0 @@
-package updater
-
-import "testing"
-
-func TestNormalizeChannel(t *testing.T) {
-	tests := []struct {
-		name  string
-		input string
-		want  string
-	}{
-		{name: "default", input: "", want: ChannelStable},
-		{name: "stable", input: "stable", want: ChannelStable},
-		{name: "stable upper", input: " STABLE ", want: ChannelStable},
-		{name: "beta", input: "beta", want: ChannelBeta},
-		{name: "unknown", input: "nightly", want: ChannelStable},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := NormalizeChannel(tt.input); got != tt.want {
-				t.Fatalf("NormalizeChannel(%q) = %q, want %q", tt.input, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestReleaseAllowedForChannel(t *testing.T) {
-	stable := Release{TagName: "v1.2.0"}
-	beta := Release{TagName: "v1.3.0-beta.1", Prerelease: true}
-	rc := Release{TagName: "v1.3.0-rc.1", Prerelease: true}
-	draft := Release{TagName: "v1.4.0-beta.1", Prerelease: true, Draft: true}
-
-	if !releaseAllowedForChannel(stable, ChannelStable) {
-		t.Fatalf("expected stable release on stable channel")
-	}
-	if releaseAllowedForChannel(beta, ChannelStable) {
-		t.Fatalf("expected beta prerelease to be excluded from stable channel")
-	}
-	if !releaseAllowedForChannel(stable, ChannelBeta) {
-		t.Fatalf("expected stable release on beta channel")
-	}
-	if !releaseAllowedForChannel(beta, ChannelBeta) {
-		t.Fatalf("expected beta prerelease on beta channel")
-	}
-	if releaseAllowedForChannel(rc, ChannelBeta) {
-		t.Fatalf("expected non-beta prerelease to be excluded from beta channel")
-	}
-	if releaseAllowedForChannel(draft, ChannelBeta) {
-		t.Fatalf("expected draft release to be excluded")
-	}
-}
-
-func TestSelectReleaseForChannel(t *testing.T) {
-	releases := []Release{
-		{TagName: "v1.2.0"},
-		{TagName: "v1.3.0-beta.1", Prerelease: true},
-		{TagName: "v1.3.0-beta.2", Prerelease: true},
-		{TagName: "v1.3.0-rc.1", Prerelease: true},
-	}
-
-	stable, err := selectReleaseForChannel(releases, ChannelStable)
-	if err != nil {
-		t.Fatalf("stable select error: %v", err)
-	}
-	if stable.TagName != "v1.2.0" {
-		t.Fatalf("stable TagName = %q, want %q", stable.TagName, "v1.2.0")
-	}
-
-	beta, err := selectReleaseForChannel(releases, ChannelBeta)
-	if err != nil {
-		t.Fatalf("beta select error: %v", err)
-	}
-	if beta.TagName != "v1.3.0-beta.2" {
-		t.Fatalf("beta TagName = %q, want %q", beta.TagName, "v1.3.0-beta.2")
-	}
-}
diff --git a/internal/watcher/process_unix.go b/internal/watcher/process_unix.go
new file mode 100644
index 0000000..b4d6f88
--- /dev/null
+++ b/internal/watcher/process_unix.go
@@ -0,0 +1,46 @@
+//go:build !windows
+
+package watcher
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+)
+
+func configureProcessGroup(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+}
+
+func stopProcessTree(cmd *exec.Cmd, signalName string) error {
+	if cmd == nil || cmd.Process == nil {
+		return nil
+	}
+	var signal syscall.Signal
+	switch strings.ToUpper(strings.TrimSpace(signalName)) {
+	case "SIGINT", "INT":
+		signal = syscall.SIGINT
+	case "SIGKILL", "KILL":
+		signal = syscall.SIGKILL
+	default:
+		signal = syscall.SIGTERM
+	}
+	return signalProcessGroup(cmd.Process.Pid, signal)
+}
+
+func killProcessTree(cmd *exec.Cmd) error {
+	if cmd == nil || cmd.Process == nil {
+		return nil
+	}
+	return signalProcessGroup(cmd.Process.Pid, syscall.SIGKILL)
+}
+
+func signalProcessGroup(pid int, signal syscall.Signal) error {
+	err := syscall.Kill(-pid, signal)
+	if errors.Is(err, syscall.ESRCH) {
+		return os.ErrProcessDone
+	}
+	return err
+}
diff --git a/internal/watcher/process_windows.go b/internal/watcher/process_windows.go
new file mode 100644
index 0000000..2908241
--- /dev/null
+++ b/internal/watcher/process_windows.go
@@ -0,0 +1,26 @@
+//go:build windows
+
+package watcher
+
+import (
+	"os/exec"
+	"strconv"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
+
+func configureProcessGroup(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{CreationFlags: windows.CREATE_NEW_PROCESS_GROUP}
+}
+
+func stopProcessTree(cmd *exec.Cmd, _ string) error {
+	return killProcessTree(cmd)
+}
+
+func killProcessTree(cmd *exec.Cmd) error {
+	if cmd == nil || cmd.Process == nil {
+		return nil
+	}
+	return exec.Command("taskkill", "/T", "/F", "/PID", strconv.Itoa(cmd.Process.Pid)).Run()
+}
diff --git a/internal/watcher/restarter.go b/internal/watcher/restarter.go
index 1e2a1d6..d8cf325 100644
--- a/internal/watcher/restarter.go
+++ b/internal/watcher/restarter.go
@@ -7,10 +7,8 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
 	"github.com/newcore-network/opencore-cli/internal/config"
@@ -81,6 +79,8 @@ type processRestarter struct {
 	ctx         context.Context
 	cancelWatch context.CancelFunc
 	cmd         *exec.Cmd
+	done        chan error
+	stopping    map[*exec.Cmd]struct{}
 	running     bool
 }
 
@@ -134,6 +134,7 @@ func (r *processRestarter) startLocked() error {
 	cmd.Stdout = r.stdout
 	cmd.Stderr = r.stderr
 	cmd.Stdin = os.Stdin
+	configureProcessGroup(cmd)
 
 	if cwd := strings.TrimSpace(r.config.Cwd); cwd != "" {
 		if !filepath.IsAbs(cwd) {
@@ -154,17 +155,23 @@ func (r *processRestarter) startLocked() error {
 	}
 
 	r.cmd = cmd
+	r.done = make(chan error, 1)
 	r.running = true
+	done := r.done
 
 	go func() {
 		err := cmd.Wait()
+		done <- err
+		close(done)
 		r.mu.Lock()
 		defer r.mu.Unlock()
+		_, expected := r.stopping[cmd]
+		delete(r.stopping, cmd)
 		if r.cmd == cmd {
 			r.cmd = nil
 			r.running = false
 		}
-		if err != nil && !errors.Is(err, context.Canceled) && r.ctx.Err() == nil {
+		if err != nil && !expected && !errors.Is(err, context.Canceled) && r.ctx.Err() == nil {
 			fmt.Fprintf(r.stderr, "[opencore dev] managed process exited: %v\n", err)
 		}
 	}()
@@ -175,81 +182,52 @@ func (r *processRestarter) startLocked() error {
 func (r *processRestarter) stopLocked() error {
 	if r.cmd == nil || r.cmd.Process == nil || !r.running {
 		r.cmd = nil
+		r.done = nil
 		r.running = false
 		return nil
 	}
 
-	proc := r.cmd.Process
 	cmd := r.cmd
+	done := r.done
+	if r.stopping == nil {
+		r.stopping = make(map[*exec.Cmd]struct{})
+	}
+	r.stopping[cmd] = struct{}{}
 	stopTimeout := time.Duration(r.config.StopTimeoutMs) * time.Millisecond
 	if stopTimeout <= 0 {
 		stopTimeout = 5 * time.Second
 	}
 
-	if err := sendStopSignal(proc, r.config.StopSignal); err != nil {
-		_ = proc.Kill()
+	if err := stopProcessTree(cmd, r.config.StopSignal); err != nil {
+		_ = killProcessTree(cmd)
 	}
 
-	deadline := time.Now().Add(stopTimeout)
-	for time.Now().Before(deadline) {
-		if !processRunning(cmd.ProcessState, proc.Pid) {
-			r.cmd = nil
-			r.running = false
-			return nil
-		}
-		time.Sleep(100 * time.Millisecond)
+	timer := time.NewTimer(stopTimeout)
+	defer timer.Stop()
+	select {
+	case <-done:
+		r.cmd = nil
+		r.done = nil
+		r.running = false
+		return nil
+	case <-timer.C:
 	}
 
-	if err := proc.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
+	if err := killProcessTree(cmd); err != nil && !errors.Is(err, os.ErrProcessDone) {
 		return err
 	}
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		return fmt.Errorf("managed process did not exit after being killed")
+	}
 
 	r.cmd = nil
+	r.done = nil
 	r.running = false
 	return nil
 }
 
-func processRunning(state *os.ProcessState, pid int) bool {
-	if state != nil && state.Exited() {
-		return false
-	}
-	proc, err := os.FindProcess(pid)
-	if err != nil {
-		return false
-	}
-	if runtime.GOOS == "windows" {
-		return proc.Signal(syscall.Signal(0)) == nil
-	}
-	return proc.Signal(syscall.Signal(0)) == nil
-}
-
-func sendStopSignal(proc *os.Process, signalName string) error {
-	if proc == nil {
-		return nil
-	}
-
-	sig := strings.ToUpper(strings.TrimSpace(signalName))
-	switch sig {
-	case "", "SIGTERM", "TERM":
-		if runtime.GOOS == "windows" {
-			return proc.Kill()
-		}
-		return proc.Signal(syscall.SIGTERM)
-	case "SIGINT", "INT":
-		if runtime.GOOS == "windows" {
-			return proc.Signal(os.Interrupt)
-		}
-		return proc.Signal(os.Interrupt)
-	case "SIGKILL", "KILL":
-		return proc.Kill()
-	default:
-		if runtime.GOOS == "windows" {
-			return proc.Kill()
-		}
-		return proc.Signal(syscall.SIGTERM)
-	}
-}
-
 func newRestarter(cfg *config.Config) (restarter, error) {
 	mode := cfg.Dev.RestartMode()
 	runtimeKind := cfg.RuntimeKind()
diff --git a/internal/watcher/restarter_test.go b/internal/watcher/restarter_test.go
index 4dd35e9..092bdf0 100644
--- a/internal/watcher/restarter_test.go
+++ b/internal/watcher/restarter_test.go
@@ -1,11 +1,23 @@
 package watcher
 
 import (
+	"context"
+	"errors"
 	"testing"
 
+	"github.com/newcore-network/opencore-cli/internal/builder"
 	"github.com/newcore-network/opencore-cli/internal/config"
 )
 
+type failingRestarter struct {
+	err error
+}
+
+func (r *failingRestarter) Mode() string                { return "process" }
+func (r *failingRestarter) Start(context.Context) error { return nil }
+func (r *failingRestarter) Restart([]string) error      { return r.err }
+func (r *failingRestarter) Stop() error                 { return nil }
+
 func TestNewRestarterUsesProcessInAutoMode(t *testing.T) {
 	cfg := &config.Config{
 		Dev: config.DevConfig{
@@ -24,6 +36,18 @@ func TestNewRestarterUsesProcessInAutoMode(t *testing.T) {
 	}
 }
 
+func TestNotifyFrameworkReturnsRestartFailure(t *testing.T) {
+	w := &Watcher{}
+	want := errors.New("restart unavailable")
+	err := w.notifyFramework(&failingRestarter{err: want}, []builder.BuildResult{{
+		Task:    builder.BuildTask{ResourceName: "core"},
+		Success: true,
+	}})
+	if !errors.Is(err, want) {
+		t.Fatalf("notifyFramework error = %v, want %v", err, want)
+	}
+}
+
 func TestNewRestarterUsesTxAdminForFiveM(t *testing.T) {
 	cfg := &config.Config{
 		Adapter: &config.AdapterConfig{Server: &config.AdapterBinding{Name: "fivem"}},
diff --git a/internal/watcher/restarter_unix_test.go b/internal/watcher/restarter_unix_test.go
new file mode 100644
index 0000000..92e4ea3
--- /dev/null
+++ b/internal/watcher/restarter_unix_test.go
@@ -0,0 +1,40 @@
+//go:build !windows
+
+package watcher
+
+import (
+	"context"
+	"errors"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/newcore-network/opencore-cli/internal/config"
+)
+
+func TestProcessRestarterStopsProcessGroup(t *testing.T) {
+	r := newProcessRestarter(config.DevProcessConfig{
+		Command:       "sh",
+		Args:          []string{"-c", "sleep 30 & wait"},
+		StopTimeoutMs: 500,
+	})
+	if err := r.Start(context.Background()); err != nil {
+		t.Fatalf("Start failed: %v", err)
+	}
+	pid := r.cmd.Process.Pid
+
+	if err := r.Stop(); err != nil {
+		t.Fatalf("Stop failed: %v", err)
+	}
+	deadline := time.Now().Add(time.Second)
+	for {
+		err := syscall.Kill(-pid, 0)
+		if errors.Is(err, syscall.ESRCH) {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("process group %d still exists: %v", pid, err)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
diff --git a/internal/watcher/watcher.go b/internal/watcher/watcher.go
index 55d0a63..069bfca 100644
--- a/internal/watcher/watcher.go
+++ b/internal/watcher/watcher.go
@@ -8,9 +8,12 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 	"sync"
 	"time"
+	"unicode"
+	"unicode/utf8"
 
 	"github.com/charmbracelet/lipgloss"
 	"github.com/fsnotify/fsnotify"
@@ -21,14 +24,69 @@ import (
 )
 
 type Watcher struct {
-	config         *config.Config
-	builder        *builder.Builder
-	watcher        *fsnotify.Watcher
-	debounceTimers map[string]*time.Timer
-	restarter      restarter
-	logQueue       chan LogMessage
-	buildingMutex  sync.Mutex
-	buildingSet    map[string]bool // Track which resources are currently being built
+	config    *config.Config
+	builder   *builder.Builder
+	watcher   *fsnotify.Watcher
+	restarter restarter
+	logQueue  chan LogMessage
+	closeOnce sync.Once
+	closeErr  error
+}
+
+const (
+	debounceDelay = 500 * time.Millisecond
+	maxLogBody    = 1 << 20
+	maxLogDomain  = 256
+	maxLogMessage = 16 << 10
+	maxLogStack   = 64 << 10
+)
+
+type buildRequest struct {
+	generation   uint64
+	builder      *builder.Builder
+	tasks        []builder.BuildTask
+	full         bool
+	startRuntime bool
+}
+
+type buildOutcome struct {
+	request buildRequest
+	results []builder.BuildResult
+	err     error
+}
+
+type debounceState map[string]time.Time
+
+func (d debounceState) add(path string, now time.Time) {
+	d[path] = now.Add(debounceDelay)
+}
+
+func (d debounceState) takeDue(now time.Time) []string {
+	var due []string
+	for path, deadline := range d {
+		if !deadline.After(now) {
+			due = append(due, path)
+			delete(d, path)
+		}
+	}
+	sort.Strings(due)
+	return due
+}
+
+func (d debounceState) next(now time.Time) time.Duration {
+	var earliest time.Time
+	for _, deadline := range d {
+		if earliest.IsZero() || deadline.Before(earliest) {
+			earliest = deadline
+		}
+	}
+	if earliest.IsZero() {
+		return -1
+	}
+	if wait := earliest.Sub(now); wait > 0 {
+		return wait
+	}
+	return 0
 }
 
 func New(cfg *config.Config) (*Watcher, error) {
@@ -38,16 +96,15 @@ func New(cfg *config.Config) (*Watcher, error) {
 	}
 
 	watcher := &Watcher{
-		config:         cfg,
-		builder:        builder.New(cfg),
-		watcher:        w,
-		debounceTimers: make(map[string]*time.Timer),
-		logQueue:       make(chan LogMessage, 256),
-		buildingSet:    make(map[string]bool),
+		config:   cfg,
+		builder:  newDevBuilder(cfg),
+		watcher:  w,
+		logQueue: make(chan LogMessage, 256),
 	}
 
 	restarter, err := newRestarter(cfg)
 	if err != nil {
+		_ = w.Close()
 		return nil, err
 	}
 	watcher.restarter = restarter
@@ -56,12 +113,17 @@ func New(cfg *config.Config) (*Watcher, error) {
 }
 
 func (w *Watcher) Watch(ctx context.Context) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
 	allTasks := w.builder.CollectTasks()
+	restarter := w.restarter
+	defer func() { _ = restarter.Stop() }()
 
 	// Watch config file for dynamic updates
 	configPath := "opencore.config.ts"
 	if _, err := os.Stat(configPath); err == nil {
-		if err := w.watcher.Add(configPath); err != nil {
+		if err := w.watcher.Add(filepath.Dir(configPath)); err != nil {
 			fmt.Println(ui.Warning(fmt.Sprintf("Failed to watch %s: %v", configPath, err)))
 		} else {
 			fmt.Println(ui.Info(fmt.Sprintf("Watching configuration: %s", configPath)))
@@ -119,14 +181,13 @@ func (w *Watcher) Watch(ctx context.Context) error {
 		statusStyle.Render(strings.Join(statusParts, " | ")))
 
 	fmt.Println(ui.Muted(fmt.Sprintf("Bridge: http://localhost:%d/logs", w.config.Dev.BridgePort())))
-	switch w.restarter.Mode() {
+	switch restarter.Mode() {
 	case "txadmin":
 		fmt.Println(ui.Info(fmt.Sprintf("Restart mode: txAdmin (%s)", w.config.Dev.TxAdmin.URL)))
 		fmt.Println(ui.Muted("Authenticating with txAdmin..."))
-		if err := w.restarter.Start(ctx); err != nil {
-			fmt.Println(ui.Warning(fmt.Sprintf("txAdmin login failed: %v", err)))
-			fmt.Println(ui.Warning("Automatic restarts via txAdmin are disabled until credentials work."))
-			w.restarter = &noopRestarter{}
+		if err := restarter.Start(ctx); err != nil {
+			_ = w.Close()
+			return fmt.Errorf("txAdmin login failed: %w", err)
 		} else {
 			fmt.Println(ui.Success("Connected to txAdmin"))
 		}
@@ -139,159 +200,175 @@ func (w *Watcher) Watch(ctx context.Context) error {
 	fmt.Println(ui.Muted("Watching for changes... (Ctrl+C to stop)"))
 	fmt.Println()
 
-	// Build once at start
-	if err := w.builder.BuildWithOutputContext(ctx, builder.OutputModeAuto); err != nil {
-		fmt.Println(ui.Error(fmt.Sprintf("Initial build failed: %v", err)))
-	} else if err := w.restarter.Start(ctx); err != nil {
-		fmt.Println(ui.Error(fmt.Sprintf("Failed to start dev runtime: %v", err)))
+	buildRequests := make(chan buildRequest, 1)
+	buildResults := make(chan buildOutcome, 1)
+	go runBuildWorker(ctx, buildRequests, buildResults)
+
+	var generation uint64
+	building := false
+	pendingFull := false
+	tasksDirty := false
+	pendingPaths := make(map[string]struct{})
+	debounces := make(debounceState)
+	timer := time.NewTimer(time.Hour)
+	if !timer.Stop() {
+		<-timer.C
+	}
+	defer timer.Stop()
+	var timerC <-chan time.Time
+
+	resetTimer := func() {
+		if !timer.Stop() {
+			select {
+			case <-timer.C:
+			default:
+			}
+		}
+		wait := debounces.next(time.Now())
+		if wait < 0 {
+			timerC = nil
+			return
+		}
+		timer.Reset(wait)
+		timerC = timer.C
 	}
 
-	// Watch for changes
-	for {
-		select {
-		case <-ctx.Done():
-			return nil
-		case event, ok := <-w.watcher.Events:
-			if !ok {
-				return nil
+	startBuild := func(paths map[string]struct{}, full, startRuntime bool) bool {
+		if building {
+			if full {
+				pendingFull = true
 			}
-			if w.shouldIgnorePath(event.Name) {
-				continue
+			for path := range paths {
+				pendingPaths[path] = struct{}{}
 			}
+			return false
+		}
 
-			if event.Op&fsnotify.Write == fsnotify.Write {
-				// Debounce using timer - wait for 500ms of silence before processing
-				fileName := event.Name
-
-				// Cancel existing timer for this file if any
-				if timer, exists := w.debounceTimers[fileName]; exists {
-					timer.Stop()
-				}
-
-				// Create new timer that will execute after 500ms of silence
-				w.debounceTimers[fileName] = time.AfterFunc(500*time.Millisecond, func() {
-					if ctx.Err() != nil {
-						delete(w.debounceTimers, fileName)
-						return
-					}
-					// Handle config file change
-					if filepath.Base(fileName) == "opencore.config.ts" {
-						fmt.Println(ui.Info("Configuration changed, reloading..."))
-						newCfg, root, err := config.LoadWithProjectRoot()
-						if err != nil {
-							fmt.Println(ui.Error(fmt.Sprintf("Failed to reload config: %v", err)))
-							return
-						}
-						if err := os.Chdir(root); err != nil {
-							fmt.Println(ui.Error(fmt.Sprintf("Failed to switch to project root: %v", err)))
-							return
-						}
-						w.config = newCfg
-						w.builder = builder.New(newCfg)
-						newRestarter, restarterErr := newRestarter(newCfg)
-						if restarterErr != nil {
-							fmt.Println(ui.Error(fmt.Sprintf("Failed to configure restart mode: %v", restarterErr)))
-							return
-						}
-						if w.restarter != nil {
-							_ = w.restarter.Stop()
-						}
-						w.restarter = newRestarter
-						allTasks = w.builder.CollectTasks()
-
-						// Re-add all paths (fsnotify handles duplicates)
-						w.registerPaths()
-
-						fmt.Println(ui.Info("Config reloaded, triggering full build..."))
-						if err := w.builder.BuildWithOutputContext(ctx, builder.OutputModeAuto); err != nil {
-							fmt.Println(ui.Error(fmt.Sprintf("Build failed: %v", err)))
-						} else if err := w.restarter.Start(ctx); err != nil {
-							fmt.Println(ui.Error(fmt.Sprintf("Failed to start dev runtime: %v", err)))
-						}
-						return
-					}
-
-					affected := w.tasksForChangedFile(allTasks, fileName)
-					if len(affected) == 0 {
-						fmt.Println(ui.Muted(fmt.Sprintf("File changed (ignored): %s", filepath.Base(fileName))))
-						return
+		request := buildRequest{generation: generation, builder: w.builder, full: full, startRuntime: startRuntime}
+		if tasksDirty {
+			allTasks = w.builder.CollectTasks()
+			tasksDirty = false
+		}
+		if full {
+		} else {
+			seen := make(map[string]struct{})
+			for path := range paths {
+				for _, task := range w.tasksForChangedFile(allTasks, path) {
+					key := task.Path + "\x00" + task.ResourceName
+					if _, ok := seen[key]; !ok {
+						seen[key] = struct{}{}
+						request.tasks = append(request.tasks, task)
 					}
+				}
+			}
+			if len(request.tasks) == 0 {
+				return false
+			}
+		}
+		building = true
+		buildRequests <- request
+		return true
+	}
 
-					// Get unique base resources from affected tasks
-					affectedResources := make(map[string]bool)
-					for _, task := range affected {
-						baseResource := strings.Split(task.ResourceName, "/")[0]
-						affectedResources[baseResource] = true
-					}
+	startBuild(nil, true, true)
 
-					// Check if any of these resources are already being built
-					w.buildingMutex.Lock()
-					shouldSkip := false
-					for resource := range affectedResources {
-						if w.buildingSet[resource] {
-							shouldSkip = true
-							break
-						}
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-timerC:
+			due := debounces.takeDue(time.Now())
+			resetTimer()
+			paths := make(map[string]struct{}, len(due))
+			for _, path := range due {
+				if filepath.Base(path) == "opencore.config.ts" {
+					fmt.Println(ui.Info("Configuration changed, reloading..."))
+					newCfg, root, err := config.LoadWithProjectRoot()
+					if err != nil {
+						fmt.Println(ui.Error(fmt.Sprintf("Failed to reload config: %v", err)))
+						continue
 					}
-
-					if shouldSkip {
-						w.buildingMutex.Unlock()
-						fmt.Println(ui.Muted(fmt.Sprintf("Build already in progress for %s, skipping...", filepath.Base(fileName))))
-						delete(w.debounceTimers, fileName)
-						return
+					if err := os.Chdir(root); err != nil {
+						fmt.Println(ui.Error(fmt.Sprintf("Failed to switch to project root: %v", err)))
+						continue
 					}
-
-					// Mark all affected resources as being built
-					for resource := range affectedResources {
-						w.buildingSet[resource] = true
+					newRestarter, err := newRestarter(newCfg)
+					if err != nil {
+						fmt.Println(ui.Error(fmt.Sprintf("Failed to configure restart mode: %v", err)))
+						continue
 					}
-					w.buildingMutex.Unlock()
-
-					// Perform the build
-					fmt.Println(ui.Info(fmt.Sprintf("File changed: %s", filepath.Base(fileName))))
-					results, err := w.builder.BuildTasksContext(ctx, affected)
-
-					// Unmark resources as being built
-					w.buildingMutex.Lock()
-					for resource := range affectedResources {
-						delete(w.buildingSet, resource)
+					if err := restarter.Stop(); err != nil {
+						_ = w.Close()
+						return fmt.Errorf("failed to stop previous dev runtime: %w", err)
 					}
-					w.buildingMutex.Unlock()
-
-					if err != nil {
-						fmt.Println(ui.Error(fmt.Sprintf("Build failed: %v", err)))
-						delete(w.debounceTimers, fileName)
-						return
+					restarter = newRestarter
+					w.config = newCfg
+					w.builder = newDevBuilder(newCfg)
+					generation++
+					tasksDirty = true
+					w.registerPaths()
+					pendingFull = true
+					fmt.Println(ui.Info("Config reloaded, triggering full build..."))
+					continue
+				}
+				paths[path] = struct{}{}
+			}
+			if pendingFull {
+				if startBuild(nil, true, true) {
+					pendingFull = false
+					pendingPaths = make(map[string]struct{})
+				}
+			} else {
+				startBuild(paths, false, false)
+			}
+		case outcome := <-buildResults:
+			building = false
+			if outcome.request.generation == generation {
+				if outcome.err != nil {
+					fmt.Println(ui.Error(fmt.Sprintf("Build failed: %v", outcome.err)))
+				} else if outcome.request.startRuntime {
+					if err := restarter.Start(ctx); err != nil {
+						_ = w.Close()
+						return fmt.Errorf("failed to start dev runtime: %w", err)
 					}
+				} else if err := w.notifyFramework(restarter, outcome.results); err != nil {
+					_ = w.Close()
+					return err
+				}
+			}
 
-					// Notify framework for hot reload
-					w.notifyFramework(results)
+			if pendingFull {
+				pendingFull = false
+				pendingPaths = make(map[string]struct{})
+				startBuild(nil, true, true)
+			} else if len(pendingPaths) > 0 {
+				paths := pendingPaths
+				pendingPaths = make(map[string]struct{})
+				startBuild(paths, false, false)
+			}
+		case event, ok := <-w.watcher.Events:
+			if !ok {
+				return nil
+			}
+			if w.shouldIgnorePath(event.Name) {
+				continue
+			}
 
-					// Clean up timer reference
-					delete(w.debounceTimers, fileName)
-				})
+			if event.Op&(fsnotify.Write|fsnotify.Create|fsnotify.Remove|fsnotify.Rename) == 0 {
+				continue
 			}
 
-			if event.Op&fsnotify.Create == fsnotify.Create {
+			if event.Op&fsnotify.Create != 0 {
 				info, err := os.Stat(event.Name)
 				if err == nil && info.IsDir() {
-					if w.shouldIgnorePath(event.Name) {
-						continue
-					}
-					// Automatically watch new directories
-					w.watcher.Add(event.Name)
-
-					// Re-collect tasks to include new resource if it matches globs
-					newCfg, root, _ := config.LoadWithProjectRoot()
-					if newCfg != nil {
-						_ = os.Chdir(root)
-						w.config = newCfg
-						w.builder = builder.New(newCfg)
-						allTasks = w.builder.CollectTasks()
-					}
+					w.registerDirectory(event.Name)
 				}
 			}
-
+			if event.Op&(fsnotify.Create|fsnotify.Remove|fsnotify.Rename) != 0 {
+				tasksDirty = true
+			}
+			debounces.add(event.Name, time.Now())
+			resetTimer()
 		case err, ok := <-w.watcher.Errors:
 			if !ok {
 				return nil
@@ -301,6 +378,28 @@ func (w *Watcher) Watch(ctx context.Context) error {
 	}
 }
 
+func runBuildWorker(ctx context.Context, requests <-chan buildRequest, outcomes chan<- buildOutcome) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case request := <-requests:
+			outcome := buildOutcome{request: request}
+			if request.full {
+				outcome.err = request.builder.BuildWithOutputContext(ctx, builder.OutputModeAuto)
+			} else {
+				regenerateTypes(request.builder, request.tasks)
+				outcome.results, outcome.err = request.builder.BuildTasksContext(ctx, request.tasks)
+			}
+			select {
+			case outcomes <- outcome:
+			case <-ctx.Done():
+				return
+			}
+		}
+	}
+}
+
 // registerPaths adds all source directories to the watcher
 func (w *Watcher) registerPaths() {
 	// 1. Watch the project root for config changes (already added in Watch())
@@ -363,6 +462,38 @@ func (w *Watcher) registerPaths() {
 	}
 }
 
+func (w *Watcher) registerDirectory(root string) {
+	_ = filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
+		if err != nil || !entry.IsDir() {
+			return nil
+		}
+		if w.shouldIgnorePath(path) {
+			return filepath.SkipDir
+		}
+		_ = w.watcher.Add(path)
+		return nil
+	})
+}
+
+func regenerateTypes(b *builder.Builder, tasks []builder.BuildTask) {
+	resourceBuilder := b.ResourceBuilder()
+	if resourceBuilder == nil {
+		return
+	}
+
+	seen := make(map[string]bool, len(tasks))
+	for _, task := range tasks {
+		if task.Type == builder.TypeViews || seen[task.Path] {
+			continue
+		}
+		seen[task.Path] = true
+
+		if resourceBuilder.RunTypegen(task.Path) {
+			fmt.Println(ui.Muted(fmt.Sprintf("  types regenerated: %s", task.ResourceName)))
+		}
+	}
+}
+
 func (w *Watcher) tasksForChangedFile(all []builder.BuildTask, changedFile string) []builder.BuildTask {
 	if w.shouldIgnorePath(changedFile) {
 		return nil
@@ -472,14 +603,14 @@ func isPathWithin(path string, root string) bool {
 }
 
 func (w *Watcher) Close() error {
-	if w.restarter != nil {
-		_ = w.restarter.Stop()
-	}
-	return w.watcher.Close()
+	w.closeOnce.Do(func() {
+		w.closeErr = w.watcher.Close()
+	})
+	return w.closeErr
 }
 
 // notifyFramework restarts affected resources or the managed process.
-func (w *Watcher) notifyFramework(results []builder.BuildResult) {
+func (w *Watcher) notifyFramework(r restarter, results []builder.BuildResult) error {
 	// Find unique resources that were successfully built
 	uniqueResources := make(map[string]struct{})
 	for _, r := range results {
@@ -493,23 +624,24 @@ func (w *Watcher) notifyFramework(results []builder.BuildResult) {
 	for resourceName := range uniqueResources {
 		resources = append(resources, resourceName)
 	}
-	if err := w.restarter.Restart(resources); err != nil {
-		fmt.Println(ui.Error(fmt.Sprintf("Restart failed: %v", err)))
-		return
+	sort.Strings(resources)
+	if err := r.Restart(resources); err != nil {
+		return fmt.Errorf("restart failed: %w", err)
 	}
 
-	if len(resources) == 0 || w.restarter.Mode() == "none" {
-		return
+	if len(resources) == 0 || r.Mode() == "none" {
+		return nil
 	}
 
-	if w.restarter.Mode() == "process" {
+	if r.Mode() == "process" {
 		fmt.Println(ui.Success("Managed server process restarted"))
-		return
+		return nil
 	}
 
 	for _, resourceName := range resources {
-		fmt.Println(ui.Success(fmt.Sprintf("Restart triggered for %s (via %s)", resourceName, w.restarter.Mode())))
+		fmt.Println(ui.Success(fmt.Sprintf("Restart triggered for %s (via %s)", resourceName, r.Mode())))
 	}
+	return nil
 }
 
 type LogMessage struct {
@@ -573,12 +705,16 @@ func (w *Watcher) handleLogs(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	body, err := io.ReadAll(r.Body)
+	defer r.Body.Close()
+	if r.ContentLength > maxLogBody {
+		rw.WriteHeader(http.StatusRequestEntityTooLarge)
+		return
+	}
+	body, err := io.ReadAll(http.MaxBytesReader(rw, r.Body, maxLogBody))
 	if err != nil {
-		rw.WriteHeader(http.StatusBadRequest)
+		rw.WriteHeader(http.StatusRequestEntityTooLarge)
 		return
 	}
-	defer r.Body.Close()
 
 	var payload struct {
 		Type    string       `json:"type"`
@@ -590,6 +726,7 @@ func (w *Watcher) handleLogs(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	for _, log := range payload.Payload {
+		sanitizeLog(&log)
 		select {
 		case w.logQueue <- log:
 		default:
@@ -599,6 +736,33 @@ func (w *Watcher) handleLogs(rw http.ResponseWriter, r *http.Request) {
 	rw.WriteHeader(http.StatusAccepted)
 }
 
+func sanitizeLog(log *LogMessage) {
+	log.Domain = sanitizeTerminalText(log.Domain, maxLogDomain)
+	log.Message = sanitizeTerminalText(log.Message, maxLogMessage)
+	if log.Error != nil {
+		log.Error.Name = sanitizeTerminalText(log.Error.Name, maxLogDomain)
+		log.Error.Message = sanitizeTerminalText(log.Error.Message, maxLogMessage)
+		log.Error.Stack = sanitizeTerminalText(log.Error.Stack, maxLogStack)
+	}
+}
+
+func sanitizeTerminalText(value string, maxBytes int) string {
+	value = strings.Map(func(r rune) rune {
+		if unicode.IsControl(r) {
+			return ' '
+		}
+		return r
+	}, value)
+	if len(value) <= maxBytes {
+		return value
+	}
+	value = value[:maxBytes]
+	for !utf8.ValidString(value) {
+		value = value[:len(value)-1]
+	}
+	return value
+}
+
 func (w *Watcher) displayLog(log LogMessage) {
 	timeStr := time.Unix(log.Timestamp/1000, 0).Format("15:04:05")
 
@@ -646,3 +810,11 @@ func (w *Watcher) displayLog(log LogMessage) {
 		}
 	}
 }
+
+// newDevBuilder returns a builder whose type check warns instead of failing, so a type error
+// never stops the watch loop.
+func newDevBuilder(cfg *config.Config) *builder.Builder {
+	b := builder.New(cfg)
+	b.SetTypecheckWarnOnly(true)
+	return b
+}
diff --git a/internal/watcher/watcher_test.go b/internal/watcher/watcher_test.go
index 82165eb..3bd1a6f 100644
--- a/internal/watcher/watcher_test.go
+++ b/internal/watcher/watcher_test.go
@@ -1,8 +1,13 @@
 package watcher
 
 import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/newcore-network/opencore-cli/internal/config"
 )
@@ -15,6 +20,63 @@ func TestShouldIgnorePathForAutoloadArtifacts(t *testing.T) {
 	}
 }
 
+func TestDebounceStateReschedulesAndTakesDuePaths(t *testing.T) {
+	now := time.Unix(100, 0)
+	state := make(debounceState)
+	state.add("b.ts", now)
+	state.add("a.ts", now.Add(100*time.Millisecond))
+	state.add("b.ts", now.Add(200*time.Millisecond))
+
+	if wait := state.next(now); wait != 600*time.Millisecond {
+		t.Fatalf("next debounce = %v, want %v", wait, 600*time.Millisecond)
+	}
+	if due := state.takeDue(now.Add(650 * time.Millisecond)); len(due) != 1 || due[0] != "a.ts" {
+		t.Fatalf("due paths = %v, want [a.ts]", due)
+	}
+	if due := state.takeDue(now.Add(700 * time.Millisecond)); len(due) != 1 || due[0] != "b.ts" {
+		t.Fatalf("due paths = %v, want [b.ts]", due)
+	}
+}
+
+func TestHandleLogsRejectsOversizedBody(t *testing.T) {
+	w := &Watcher{logQueue: make(chan LogMessage, 1)}
+	request := httptest.NewRequest(http.MethodPost, "/logs", bytes.NewReader(make([]byte, maxLogBody+1)))
+	response := httptest.NewRecorder()
+
+	w.handleLogs(response, request)
+
+	if response.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusRequestEntityTooLarge)
+	}
+}
+
+func TestHandleLogsSanitizesTerminalControlCharacters(t *testing.T) {
+	w := &Watcher{logQueue: make(chan LogMessage, 1)}
+	body := `{"payload":[{"domain":"api\u001b[2J","message":"first\nsecond\r"}]}`
+	request := httptest.NewRequest(http.MethodPost, "/logs", strings.NewReader(body))
+	response := httptest.NewRecorder()
+
+	w.handleLogs(response, request)
+
+	if response.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusAccepted)
+	}
+	log := <-w.logQueue
+	if strings.ContainsAny(log.Domain+log.Message, "\x1b\n\r") {
+		t.Fatalf("control characters were not sanitized: domain=%q message=%q", log.Domain, log.Message)
+	}
+	if log.Domain != "api [2J" || log.Message != "first second " {
+		t.Fatalf("unexpected sanitized log: domain=%q message=%q", log.Domain, log.Message)
+	}
+}
+
+func TestSanitizeTerminalTextKeepsValidUTF8WhenTruncated(t *testing.T) {
+	got := sanitizeTerminalText("abéé", 5)
+	if got != "abé" {
+		t.Fatalf("sanitized text = %q, want %q", got, "abé")
+	}
+}
+
 func TestShouldIgnorePathForOutputAndDestination(t *testing.T) {
 	tmp := t.TempDir()
 	outDir := filepath.Join(tmp, "build")
diff --git a/main.go b/main.go
index 80df013..e88c991 100644
--- a/main.go
+++ b/main.go
@@ -12,11 +12,10 @@ import (
 
 	"github.com/newcore-network/opencore-cli/internal/commands"
 	"github.com/newcore-network/opencore-cli/internal/ui"
-	"github.com/newcore-network/opencore-cli/internal/updater"
 )
 
 var (
-	version = "1.5.0"
+	version = "2.0.0"
 )
 
 func main() {
@@ -67,31 +66,4 @@ func main() {
 		os.Exit(1)
 	}
 
-	// Check for updates in the background after command execution
-	if shouldCheckForUpdates(os.Args) {
-		channel := updater.GetConfiguredChannel()
-		if info, err := updater.CheckForUpdate(version, false, channel); err == nil {
-			if updater.NeedsUpdate(version, info.LatestVersion) {
-				fmt.Println()
-				fmt.Println(ui.Info(fmt.Sprintf("New %s version available: %s -> %s", channel, version, info.LatestVersion)))
-				fmt.Println(ui.Info(fmt.Sprintf("Run 'opencore update --channel %s' to update.", channel)))
-			}
-		}
-	}
-}
-
-func shouldCheckForUpdates(args []string) bool {
-	if len(args) <= 1 {
-		return false
-	}
-
-	if args[1] == "update" || args[1] == "--version" || args[1] == "-v" {
-		return false
-	}
-
-	if ui.IsUpdateCheckDisabled() || ui.IsNonInteractiveSession() {
-		return false
-	}
-
-	return true
 }
diff --git a/main_test.go b/main_test.go
deleted file mode 100644
index aec4953..0000000
--- a/main_test.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package main
-
-import "testing"
-
-func TestShouldCheckForUpdatesDisabledByEnv(t *testing.T) {
-	t.Setenv("OPENCORE_DISABLE_UPDATE_CHECK", "1")
-
-	if shouldCheckForUpdates([]string{"opencore", "build"}) {
-		t.Fatalf("expected update check to be disabled by env")
-	}
-}
-
-func TestShouldCheckForUpdatesSkipsVersionAndUpdate(t *testing.T) {
-	t.Setenv("OPENCORE_DISABLE_UPDATE_CHECK", "")
-
-	if shouldCheckForUpdates([]string{"opencore", "update"}) {
-		t.Fatalf("expected update command to skip update checks")
-	}
-
-	if shouldCheckForUpdates([]string{"opencore", "--version"}) {
-		t.Fatalf("expected --version command to skip update checks")
-	}
-}
-
-func TestShouldCheckForUpdatesSkipsShortVersionFlag(t *testing.T) {
-	t.Setenv("OPENCORE_DISABLE_UPDATE_CHECK", "")
-
-	if shouldCheckForUpdates([]string{"opencore", "-v"}) {
-		t.Fatalf("expected -v command to skip update checks")
-	}
-}
diff --git a/npm/darwin-arm64/.npmignore b/npm/darwin-arm64/.npmignore
new file mode 100644
index 0000000..130504f
--- /dev/null
+++ b/npm/darwin-arm64/.npmignore
@@ -0,0 +1,3 @@
+*
+!bin/
+!bin/opencore
diff --git a/npm/darwin-arm64/package.json b/npm/darwin-arm64/package.json
new file mode 100644
index 0000000..1de135a
--- /dev/null
+++ b/npm/darwin-arm64/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "@open-core/cli-darwin-arm64",
+  "version": "2.0.0",
+  "description": "OpenCore CLI binary for macOS arm64",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/newcore-network/opencore-cli.git",
+    "directory": "npm/darwin-arm64"
+  },
+  "os": ["darwin"],
+  "cpu": ["arm64"],
+  "files": ["bin/opencore"],
+  "publishConfig": {"access": "public"}
+}
diff --git a/npm/darwin-x64/.npmignore b/npm/darwin-x64/.npmignore
new file mode 100644
index 0000000..130504f
--- /dev/null
+++ b/npm/darwin-x64/.npmignore
@@ -0,0 +1,3 @@
+*
+!bin/
+!bin/opencore
diff --git a/npm/darwin-x64/package.json b/npm/darwin-x64/package.json
new file mode 100644
index 0000000..d038e86
--- /dev/null
+++ b/npm/darwin-x64/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "@open-core/cli-darwin-x64",
+  "version": "2.0.0",
+  "description": "OpenCore CLI binary for macOS x64",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/newcore-network/opencore-cli.git",
+    "directory": "npm/darwin-x64"
+  },
+  "os": ["darwin"],
+  "cpu": ["x64"],
+  "files": ["bin/opencore"],
+  "publishConfig": {"access": "public"}
+}
diff --git a/npm/linux-arm64/.npmignore b/npm/linux-arm64/.npmignore
new file mode 100644
index 0000000..130504f
--- /dev/null
+++ b/npm/linux-arm64/.npmignore
@@ -0,0 +1,3 @@
+*
+!bin/
+!bin/opencore
diff --git a/npm/linux-arm64/package.json b/npm/linux-arm64/package.json
new file mode 100644
index 0000000..91b6c6f
--- /dev/null
+++ b/npm/linux-arm64/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "@open-core/cli-linux-arm64",
+  "version": "2.0.0",
+  "description": "OpenCore CLI binary for Linux arm64",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/newcore-network/opencore-cli.git",
+    "directory": "npm/linux-arm64"
+  },
+  "os": ["linux"],
+  "cpu": ["arm64"],
+  "files": ["bin/opencore"],
+  "publishConfig": {"access": "public"}
+}
diff --git a/npm/linux-x64/.npmignore b/npm/linux-x64/.npmignore
new file mode 100644
index 0000000..130504f
--- /dev/null
+++ b/npm/linux-x64/.npmignore
@@ -0,0 +1,3 @@
+*
+!bin/
+!bin/opencore
diff --git a/npm/linux-x64/package.json b/npm/linux-x64/package.json
new file mode 100644
index 0000000..863ae7e
--- /dev/null
+++ b/npm/linux-x64/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "@open-core/cli-linux-x64",
+  "version": "2.0.0",
+  "description": "OpenCore CLI binary for Linux x64",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/newcore-network/opencore-cli.git",
+    "directory": "npm/linux-x64"
+  },
+  "os": ["linux"],
+  "cpu": ["x64"],
+  "files": ["bin/opencore"],
+  "publishConfig": {"access": "public"}
+}
diff --git a/npm/win32-x64/.npmignore b/npm/win32-x64/.npmignore
new file mode 100644
index 0000000..24f08de
--- /dev/null
+++ b/npm/win32-x64/.npmignore
@@ -0,0 +1,3 @@
+*
+!bin/
+!bin/opencore.exe
diff --git a/npm/win32-x64/package.json b/npm/win32-x64/package.json
new file mode 100644
index 0000000..543e905
--- /dev/null
+++ b/npm/win32-x64/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "@open-core/cli-win32-x64",
+  "version": "2.0.0",
+  "description": "OpenCore CLI binary for Windows x64",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/newcore-network/opencore-cli.git",
+    "directory": "npm/win32-x64"
+  },
+  "os": ["win32"],
+  "cpu": ["x64"],
+  "files": ["bin/opencore.exe"],
+  "publishConfig": {"access": "public"}
+}
diff --git a/package.json b/package.json
index ca248b5..8247977 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@open-core/cli",
-  "version": "1.5.0",
+  "version": "2.0.0",
   "description": "Official CLI tool for OpenCore Framework",
   "main": "index.js",
   "types": "index.d.ts",
@@ -17,16 +17,37 @@
     }
   },
   "bin": {
-    "opencore": "index.js"
+    "opencore": "bin/opencore.js"
   },
   "scripts": {
-    "postinstall": "node install.js"
+    "test": "node --test test/**/*.test.js",
+    "test:go": "node scripts/go-test.js",
+    "test:npm-smoke": "node scripts/smoke-npm-packages.js dist/npm",
+    "version:set": "node scripts/version.js set",
+    "version:check": "node scripts/version.js check",
+    "version:check-tag": "node scripts/version.js check-tag",
+    "release:check": "node scripts/release-check.js"
   },
   "dependencies": {
-    "esbuild": "^0.27.2",
-    "@swc/core": "^1.15.8",
+    "@swc/core": "^1.16.1",
+    "esbuild": "^0.28.1",
     "tsconfig-paths": "^4.2.0"
   },
+  "peerDependencies": {
+    "vite": "^7.1.0"
+  },
+  "peerDependenciesMeta": {
+    "vite": {
+      "optional": true
+    }
+  },
+  "optionalDependencies": {
+    "@open-core/cli-darwin-arm64": "2.0.0",
+    "@open-core/cli-darwin-x64": "2.0.0",
+    "@open-core/cli-linux-arm64": "2.0.0",
+    "@open-core/cli-linux-x64": "2.0.0",
+    "@open-core/cli-win32-x64": "2.0.0"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/newcore-network/opencore-cli.git"
@@ -41,25 +62,20 @@
   "author": "Newcore Network",
   "license": "MPL-2.0",
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=18.0.0"
   },
-  "os": [
-    "darwin",
-    "linux",
-    "win32"
-  ],
   "files": [
-    "bin/opencore",
+    "bin/opencore.js",
     "index.js",
     "index.d.ts",
     "vite.js",
     "vite.mjs",
     "vite.d.ts",
-    "binary.js",
-    "install.js",
-    "config-helper.js"
+    "config-helper.js",
+    "platform.js"
   ],
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "packageManager": "pnpm@10.33.0"
 }
diff --git a/platform.js b/platform.js
new file mode 100644
index 0000000..cda92f3
--- /dev/null
+++ b/platform.js
@@ -0,0 +1,70 @@
+const { spawnSync } = require('node:child_process');
+
+const platforms = {
+  'darwin-arm64': {
+    packageName: '@open-core/cli-darwin-arm64',
+    binary: 'opencore',
+  },
+  'darwin-x64': {
+    packageName: '@open-core/cli-darwin-x64',
+    binary: 'opencore',
+  },
+  'linux-arm64': {
+    packageName: '@open-core/cli-linux-arm64',
+    binary: 'opencore',
+  },
+  'linux-x64': {
+    packageName: '@open-core/cli-linux-x64',
+    binary: 'opencore',
+  },
+  'win32-x64': {
+    packageName: '@open-core/cli-win32-x64',
+    binary: 'opencore.exe',
+  },
+};
+
+function getPlatformPackage(platform = process.platform, arch = process.arch) {
+  return platforms[`${platform}-${arch}`] || null;
+}
+
+function getBinaryPath(platform = process.platform, arch = process.arch, resolve = require.resolve) {
+  const target = getPlatformPackage(platform, arch);
+  if (!target) {
+    throw new Error(`Unsupported platform: ${platform} ${arch}. OpenCore CLI supports Linux (x64, arm64), macOS (x64, arm64), and Windows (x64).`);
+  }
+
+  try {
+    return resolve(`${target.packageName}/bin/${target.binary}`);
+  } catch (error) {
+    throw new Error(`Missing optional dependency ${target.packageName} for ${platform} ${arch}. Reinstall @open-core/cli on this platform.`);
+  }
+}
+
+function run(args, options = {}) {
+  const platform = options.platform || process.platform;
+  const arch = options.arch || process.arch;
+  const resolve = options.resolve || require.resolve;
+  const execute = options.spawnSync || spawnSync;
+  const writeError = options.writeError || ((message) => console.error(message));
+
+  let binaryPath;
+  try {
+    binaryPath = getBinaryPath(platform, arch, resolve);
+  } catch (error) {
+    writeError(`OpenCore CLI: ${error.message}`);
+    return 1;
+  }
+
+  const result = execute(binaryPath, args, {
+    stdio: 'inherit',
+    windowsHide: true,
+  });
+  if (result.error) {
+    writeError(`OpenCore CLI: failed to execute ${binaryPath}: ${result.error.message}`);
+    return 1;
+  }
+
+  return typeof result.status === 'number' ? result.status : 1;
+}
+
+module.exports = { getPlatformPackage, getBinaryPath, run };
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
new file mode 100644
index 0000000..901d835
--- /dev/null
+++ b/pnpm-lock.yaml
@@ -0,0 +1,1013 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@swc/core':
+        specifier: ^1.16.1
+        version: 1.16.1
+      esbuild:
+        specifier: ^0.28.1
+        version: 0.28.2
+      tsconfig-paths:
+        specifier: ^4.2.0
+        version: 4.2.0
+      vite:
+        specifier: ^7.1.0
+        version: 7.3.6(lightningcss@1.33.0)
+    optionalDependencies:
+      '@open-core/cli-darwin-arm64':
+        specifier: 2.0.0
+        version: link:npm/darwin-arm64
+      '@open-core/cli-darwin-x64':
+        specifier: 2.0.0
+        version: link:npm/darwin-x64
+      '@open-core/cli-linux-arm64':
+        specifier: 2.0.0
+        version: link:npm/linux-arm64
+      '@open-core/cli-linux-x64':
+        specifier: 2.0.0
+        version: link:npm/linux-x64
+      '@open-core/cli-win32-x64':
+        specifier: 2.0.0
+        version: link:npm/win32-x64
+
+  npm/darwin-arm64: {}
+
+  npm/darwin-x64: {}
+
+  npm/linux-arm64: {}
+
+  npm/linux-x64: {}
+
+  npm/win32-x64: {}
+
+packages:
+
+  '@esbuild/aix-ppc64@0.28.2':
+    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.28.2':
+    resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.28.2':
+    resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.28.2':
+    resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.28.2':
+    resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.28.2':
+    resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.28.2':
+    resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.28.2':
+    resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.28.2':
+    resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.28.2':
+    resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.28.2':
+    resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.28.2':
+    resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.28.2':
+    resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.28.2':
+    resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.28.2':
+    resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.28.2':
+    resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.28.2':
+    resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.28.2':
+    resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.28.2':
+    resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.28.2':
+    resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.28.2':
+    resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.28.2':
+    resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.28.2':
+    resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.28.2':
+    resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    resolution: {integrity: sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==}
+    engines: {node: ^22.20 || ^24.12 || >=25}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-android-arm-eabi@4.63.1':
+    resolution: {integrity: sha512-UZ8sUxPTiHWYX9QNdJedb1kDZSpS1t/VPWBWGSgqHNi9w3Cu6IXvu2mzbhiTiPvtrqgTQJ+zqiAq2iPIPilpaQ==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.63.1':
+    resolution: {integrity: sha512-cQ4nFQABN5cDvDpbvJ7bMStCpnaVxynZrRMfUJYgxcIk9Sh54FIO1vtfkg0B69REjER77ioZ/ov+eAApx/KmLQ==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.63.1':
+    resolution: {integrity: sha512-FQNqd1lRy/0QhDk3xeRIkSBiCpXCiDnZO3YLVdcDKN1UBiKToNftCzcXYNLshmPDUMlu2TdeS8tGcsU6f3YF1Q==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.63.1':
+    resolution: {integrity: sha512-pvD16V939D3CloK0+qikpGaxiPrDUXTe7Y5cWOMkMSy7m1cawa8EGy/kXYi/G/cKAC4HDAbSnzCIk1WmsoOKXg==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.63.1':
+    resolution: {integrity: sha512-pcFGeL2345VwdTnJhA6zLbew+YgWB0qBG2+dMtXjCicf6+rm6kO6cOoh5VnTe0ZMrMRgRyuHmCJxZWrIdzYuOw==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.63.1':
+    resolution: {integrity: sha512-mRJlqSRulVzcKq/LKA6ICSIc3K/l4fzlVn/gePn2nXIHy8seRi5z/eeRE0d/XMBxcMldiXtQTSpRj0tkkC3g8Q==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.63.1':
+    resolution: {integrity: sha512-YDUNvVM85TI3g/1OpnqKP1h4NeW/j64DfWMf+G3M809xNk1bJSnpFp4sh83NpmVE5DXnkh8ULor4LTVZKoYLHw==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.63.1':
+    resolution: {integrity: sha512-7Mcn71p9ZuQFAj+h+dhQXy/yeLePRS2yKRnmW1DijA9thKO5qap0GNOIQK4yQ6iP3SU0Mrb/yWo8h8vgRba8lw==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-arm64-gnu@4.63.1':
+    resolution: {integrity: sha512-4YiLQTX6U4CSl0L9cluep9A9W6UmTfqBDc2/CH6wlu54pl4E7Jn3cOD8oxzvBDEGk/JMKgJ47C8g+radF7mwvg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm64-musl@4.63.1':
+    resolution: {integrity: sha512-2ra8F7w8OquwZN9z2/fKFnli69wa8PLwaVzRMIPGb13ByMJwC28Fbp8YcVGoUhlYMTt7j5j9bNgpysrN2UM+vw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-loong64-gnu@4.63.1':
+    resolution: {integrity: sha512-Sy20ncyhjmBP0Ml+UvQbimjlk6VFgjW5uNP+qqwHB00mTE8Bl2C1TuHTlRwK2YoXeZbee5lP2XevBWVkAQAtSQ==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-loong64-musl@4.63.1':
+    resolution: {integrity: sha512-noITLp8oNjYliPnGWmLyelIHwULGqbHloQHGw1rtxbWhTuWooRpnZarZQJ1y9EUC4szuCusCc+HEpUtxpIwYvA==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.63.1':
+    resolution: {integrity: sha512-hlxxXd+F1mWiAcaFR7Sv9ZQT6m6UfI8+Vy/kFJzztq2pDMU/0wZ9sish0iszNZvsQDo8Gc0i5yuFEOz5dDf6fA==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-ppc64-musl@4.63.1':
+    resolution: {integrity: sha512-EF7OpqQTQ/BvGqLzUi4rEHuagCV9MugAUXSHemwPW5vxZ75RR+jxO/2j95Ph2dalMpFHSVECjRoioHZgA9zOYA==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.63.1':
+    resolution: {integrity: sha512-wQO3JesW9PRkwlabQ27y7sPfVOOTLRG73I4F2UYHG5PXun3J9U3y+b7ezVKSYbsvSKGQ1k1cq8Qlun4C9kLt3w==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-riscv64-musl@4.63.1':
+    resolution: {integrity: sha512-ouAGwhO6wHRXdnOVCOsB0tRFkA7nhNB2Nwax6oECXN0YiN8EYUTBAOudADOB1PI+yDL61TeNx/u7MVCzksNbkQ==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-s390x-gnu@4.63.1':
+    resolution: {integrity: sha512-q2R38Sn+1J8RxhfJ+T54wSWmyKXWec+9jgDfqO2AtArEqHO5R2aeayp5H5OYLr5UYDVGsVaZPEFUooMhYCdz5A==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-gnu@4.63.1':
+    resolution: {integrity: sha512-gfI5T24WLLuFfSKw7Go/zDXjAAV0fny0swTaDv+WjK7vqcw4cRhFfdsyKL1n+ukI+ooBxn3bVQnyrn06WpI50w==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-musl@4.63.1':
+    resolution: {integrity: sha512-4h6XqthmB4Hspji84wvgk+ElodTsGj+dbZqHJHHtKxj4mYq0ANSEEPX9ys3moJueqsRjwpaJYH7874Itwnj2ow==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-openbsd-x64@4.63.1':
+    resolution: {integrity: sha512-dlfCOa87o1VAYegLQ9EKilx2JCeRofiyPGhTCmqnuXZ6bMPiycO1rq1+sKoulAp7pGLIsTIw+1x5R+zgh5LhhA==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.63.1':
+    resolution: {integrity: sha512-cjkLbOlfcm3QGhMM1J5zaZjsw1GggbN6rw9UTSSRrPrR1KkcXnN7Uq9rPw34xImQ9VOY9GN+6u2Zj80B9ptkcw==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.63.1':
+    resolution: {integrity: sha512-Li1KdUnWGE4N3e1F/B4RTB1ms+nG4WBgjByO46pkeBVX/2UBsY53xf5vK9WygVmnH3RwncIST7lkSdLSY6P9lg==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.63.1':
+    resolution: {integrity: sha512-t4ZYOSoLTgwhuFMrmTMLx/+i1DQVK7HYqMc6kY46EApwi8X0nIVphzdNoThU3xt6n+N5urG1/gxBdCaKDLavfg==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.63.1':
+    resolution: {integrity: sha512-RgroPfMmKlD1RzSDxvwgcPiy2HNQKoYV7OmwIXDsk73uKW5t6B/V8KIy27SMv/FNXFo/oSBtWc9J0X7t91ezZg==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.63.1':
+    resolution: {integrity: sha512-at8QVep6S3h5Y6gSbdGU06bRY5WJkf6WUduM9YtvYMbYhB1MOFfUgc6kehitQXzOtMSaT70q7f9ydPhpqu821w==}
+    cpu: [x64]
+    os: [win32]
+
+  '@swc/core-darwin-arm64@1.16.1':
+    resolution: {integrity: sha512-zlJblJ8ncErD43lKdxjbUaUskJQf+LxiPXYcWXD8/8ZMV+7uuAT+CwjciLXpyZBd5Pq/S726bMpeeAwSeL1hhg==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@swc/core-darwin-x64@1.16.1':
+    resolution: {integrity: sha512-IN0BmPWb0YAh/17mmlWB/HDBtTw2MfuW4hulf/tQAgTQBRH17l+z499bNJLK6LizSjqs0P7V+jU38Zj+vJC1DA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@swc/core-linux-arm-gnueabihf@1.16.1':
+    resolution: {integrity: sha512-EYgrx2YOCQ2Twz2S793kqNjPkpvYVUPzzR95bIb7by+VQcyaai4lZZ2iz/tZvcFVKSNcN3/JTKwx+aBn2ZL52A==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux]
+
+  '@swc/core-linux-arm64-gnu@1.16.1':
+    resolution: {integrity: sha512-moyKm0YZlHdHohzm1YwgAyesqnE853rO0REMfJLFAova51wF9BNi+3ZW2PeS7Vqvn6HeJuepLpAHbBdZctxpHA==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@swc/core-linux-arm64-musl@1.16.1':
+    resolution: {integrity: sha512-kKGBO9wdapiSzuf5ZzZ2fYtlu1BNSYtIIUxvH1ir/gcelTOREEHGDCLTDFx/2Knf878nU11A40z7LxwasEFxqA==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@swc/core-linux-ppc64-gnu@1.16.1':
+    resolution: {integrity: sha512-nZ6qahtLxC3PM54cWOQZHxt4lTCF/3J4LIoWWzz6v7A+rLs8Dx54anYQf7mH3eIi8KlNpgKci/ie8ZSqFN8O7A==}
+    engines: {node: '>=10'}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@swc/core-linux-s390x-gnu@1.16.1':
+    resolution: {integrity: sha512-4ji5PNzhYq193Z4/4xUaSoNJza6iCkDJSzhetrbB6KOYxsr+kxtQr8ePWhMJUiMt6JUWtXaZ1PYT8FhtED+nGA==}
+    engines: {node: '>=10'}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@swc/core-linux-x64-gnu@1.16.1':
+    resolution: {integrity: sha512-VJQxqrisHV+B394IgrOu8YsIIXZgffnf5tO+yc9Z/hoUpuZEvuQTjWwlnpZdpyD+0nx6LTD1/3k646JYm43yJA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@swc/core-linux-x64-musl@1.16.1':
+    resolution: {integrity: sha512-r9oV1mwxxsIGcLV1IQ/tw76MW3doatKze1QFWuC+a7QqJUkhY/bKTSVk6NpKKUGm2LDsE33Va8VqSClfA7vSiQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@swc/core-win32-arm64-msvc@1.16.1':
+    resolution: {integrity: sha512-6huNRessoBLxWEqBm5zJXyCQ27TO7anvkdiuQ5MDO4CJni0nOXEqKtV9RllQ2TdyENKKsUMXVnIfW2hIXx/R5Q==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@swc/core-win32-ia32-msvc@1.16.1':
+    resolution: {integrity: sha512-OVKJFUzphrGmsh+BGtcZDesx0YryV7/Yvy5XGgTqnrZfjnyfcr5uaqYQugCckdIlupc5Vs3XtDjRAj12z4ZPlw==}
+    engines: {node: '>=10'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@swc/core-win32-x64-msvc@1.16.1':
+    resolution: {integrity: sha512-Bt+VIhWYCGk4urklnkkteLUOeLv1VxigwTCeB/xC6rBZxY6IIKdDwCJf6on3E3SUGsIqmQS6QqtuJQc1VxF4Aw==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@swc/core@1.16.1':
+    resolution: {integrity: sha512-nUaeu91O5QZKrQdaDCHd402ogUIoNOOjpkZNq0UomWK0G6gDaGmLhvddF1/3BXf5O8aLyo6ZPY/aMDWvaJQ/hg==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@swc/helpers': '>=0.5.17'
+    peerDependenciesMeta:
+      '@swc/helpers':
+        optional: true
+
+  '@swc/counter@0.1.3':
+    resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
+
+  '@swc/types@0.1.28':
+    resolution: {integrity: sha512-V6Mnml8v09QALx6K0elJ7o9K/MkVDtW3t6L+7Ou/JcWtb3xwId2AH4FeOceySd2JaO87IMw4+6vSZxLm34LPbw==}
+
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+  detect-libc@2.1.2:
+    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+    engines: {node: '>=8'}
+
+  esbuild@0.28.2:
+    resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  lightningcss-android-arm64@1.33.0:
+    resolution: {integrity: sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [android]
+
+  lightningcss-darwin-arm64@1.33.0:
+    resolution: {integrity: sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  lightningcss-darwin-x64@1.33.0:
+    resolution: {integrity: sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  lightningcss-freebsd-x64@1.33.0:
+    resolution: {integrity: sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  lightningcss-linux-arm-gnueabihf@1.33.0:
+    resolution: {integrity: sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm]
+    os: [linux]
+
+  lightningcss-linux-arm64-gnu@1.33.0:
+    resolution: {integrity: sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  lightningcss-linux-arm64-musl@1.33.0:
+    resolution: {integrity: sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  lightningcss-linux-x64-gnu@1.33.0:
+    resolution: {integrity: sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  lightningcss-linux-x64-musl@1.33.0:
+    resolution: {integrity: sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  lightningcss-win32-arm64-msvc@1.33.0:
+    resolution: {integrity: sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  lightningcss-win32-x64-msvc@1.33.0:
+    resolution: {integrity: sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [win32]
+
+  lightningcss@1.33.0:
+    resolution: {integrity: sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==}
+    engines: {node: '>= 12.0.0'}
+
+  minimist@1.2.8:
+    resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
+
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@4.0.7:
+    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
+    engines: {node: '>=12'}
+
+  postcss@8.5.26:
+    resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  rollup@4.63.1:
+    resolution: {integrity: sha512-3Df9jsstwhccuEfmAMi9l8XUh/GOkVObmFTU7CCVBysEbcOZLl84jCtaAZMcPiMz2EGKsATzQcU+Xr3n/wU6cg==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  strip-bom@3.0.0:
+    resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
+    engines: {node: '>=4'}
+
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  tsconfig-paths@4.2.0:
+    resolution: {integrity: sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==}
+    engines: {node: '>=6'}
+
+  vite@7.3.6:
+    resolution: {integrity: sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^20.19.0 || >=22.12.0
+      jiti: '>=1.21.0'
+      less: ^4.0.0
+      lightningcss: ^1.21.0
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+snapshots:
+
+  '@esbuild/aix-ppc64@0.28.2':
+    optional: true
+
+  '@esbuild/android-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/android-arm@0.28.2':
+    optional: true
+
+  '@esbuild/android-x64@0.28.2':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/darwin-x64@0.28.2':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-arm@0.28.2':
+    optional: true
+
+  '@esbuild/linux-ia32@0.28.2':
+    optional: true
+
+  '@esbuild/linux-loong64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.28.2':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-s390x@0.28.2':
+    optional: true
+
+  '@esbuild/linux-x64@0.28.2':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.28.2':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.28.2':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/sunos-x64@0.28.2':
+    optional: true
+
+  '@esbuild/win32-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/win32-ia32@0.28.2':
+    optional: true
+
+  '@esbuild/win32-x64@0.28.2':
+    optional: true
+
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    optional: true
+
+  '@rollup/rollup-android-arm-eabi@4.63.1':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.63.1':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.63.1':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.63.1':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.63.1':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.63.1':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.63.1':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.63.1':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.63.1':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.63.1':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.63.1':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.63.1':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.63.1':
+    optional: true
+
+  '@swc/core-darwin-arm64@1.16.1':
+    optional: true
+
+  '@swc/core-darwin-x64@1.16.1':
+    optional: true
+
+  '@swc/core-linux-arm-gnueabihf@1.16.1':
+    optional: true
+
+  '@swc/core-linux-arm64-gnu@1.16.1':
+    optional: true
+
+  '@swc/core-linux-arm64-musl@1.16.1':
+    optional: true
+
+  '@swc/core-linux-ppc64-gnu@1.16.1':
+    optional: true
+
+  '@swc/core-linux-s390x-gnu@1.16.1':
+    optional: true
+
+  '@swc/core-linux-x64-gnu@1.16.1':
+    optional: true
+
+  '@swc/core-linux-x64-musl@1.16.1':
+    optional: true
+
+  '@swc/core-win32-arm64-msvc@1.16.1':
+    optional: true
+
+  '@swc/core-win32-ia32-msvc@1.16.1':
+    optional: true
+
+  '@swc/core-win32-x64-msvc@1.16.1':
+    optional: true
+
+  '@swc/core@1.16.1':
+    dependencies:
+      '@swc/counter': 0.1.3
+      '@swc/types': 0.1.28
+    optionalDependencies:
+      '@swc/core-darwin-arm64': 1.16.1
+      '@swc/core-darwin-x64': 1.16.1
+      '@swc/core-linux-arm-gnueabihf': 1.16.1
+      '@swc/core-linux-arm64-gnu': 1.16.1
+      '@swc/core-linux-arm64-musl': 1.16.1
+      '@swc/core-linux-ppc64-gnu': 1.16.1
+      '@swc/core-linux-s390x-gnu': 1.16.1
+      '@swc/core-linux-x64-gnu': 1.16.1
+      '@swc/core-linux-x64-musl': 1.16.1
+      '@swc/core-win32-arm64-msvc': 1.16.1
+      '@swc/core-win32-ia32-msvc': 1.16.1
+      '@swc/core-win32-x64-msvc': 1.16.1
+
+  '@swc/counter@0.1.3': {}
+
+  '@swc/types@0.1.28':
+    dependencies:
+      '@swc/counter': 0.1.3
+
+  '@types/estree@1.0.9': {}
+
+  detect-libc@2.1.2:
+    optional: true
+
+  esbuild@0.28.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.2
+      '@esbuild/android-arm': 0.28.2
+      '@esbuild/android-arm64': 0.28.2
+      '@esbuild/android-x64': 0.28.2
+      '@esbuild/darwin-arm64': 0.28.2
+      '@esbuild/darwin-x64': 0.28.2
+      '@esbuild/freebsd-arm64': 0.28.2
+      '@esbuild/freebsd-x64': 0.28.2
+      '@esbuild/linux-arm': 0.28.2
+      '@esbuild/linux-arm64': 0.28.2
+      '@esbuild/linux-ia32': 0.28.2
+      '@esbuild/linux-loong64': 0.28.2
+      '@esbuild/linux-mips64el': 0.28.2
+      '@esbuild/linux-ppc64': 0.28.2
+      '@esbuild/linux-riscv64': 0.28.2
+      '@esbuild/linux-s390x': 0.28.2
+      '@esbuild/linux-x64': 0.28.2
+      '@esbuild/netbsd-arm64': 0.28.2
+      '@esbuild/netbsd-x64': 0.28.2
+      '@esbuild/openbsd-arm64': 0.28.2
+      '@esbuild/openbsd-x64': 0.28.2
+      '@esbuild/openharmony-arm64': 0.28.2
+      '@esbuild/sunos-x64': 0.28.2
+      '@esbuild/win32-arm64': 0.28.2
+      '@esbuild/win32-ia32': 0.28.2
+      '@esbuild/win32-x64': 0.28.2
+
+  fdir@6.5.0(picomatch@4.0.7):
+    optionalDependencies:
+      picomatch: 4.0.7
+
+  fsevents@2.3.3:
+    optional: true
+
+  json5@2.2.3: {}
+
+  lightningcss-android-arm64@1.33.0:
+    optional: true
+
+  lightningcss-darwin-arm64@1.33.0:
+    optional: true
+
+  lightningcss-darwin-x64@1.33.0:
+    optional: true
+
+  lightningcss-freebsd-x64@1.33.0:
+    optional: true
+
+  lightningcss-linux-arm-gnueabihf@1.33.0:
+    optional: true
+
+  lightningcss-linux-arm64-gnu@1.33.0:
+    optional: true
+
+  lightningcss-linux-arm64-musl@1.33.0:
+    optional: true
+
+  lightningcss-linux-x64-gnu@1.33.0:
+    optional: true
+
+  lightningcss-linux-x64-musl@1.33.0:
+    optional: true
+
+  lightningcss-win32-arm64-msvc@1.33.0:
+    optional: true
+
+  lightningcss-win32-x64-msvc@1.33.0:
+    optional: true
+
+  lightningcss@1.33.0:
+    dependencies:
+      detect-libc: 2.1.2
+    optionalDependencies:
+      lightningcss-android-arm64: 1.33.0
+      lightningcss-darwin-arm64: 1.33.0
+      lightningcss-darwin-x64: 1.33.0
+      lightningcss-freebsd-x64: 1.33.0
+      lightningcss-linux-arm-gnueabihf: 1.33.0
+      lightningcss-linux-arm64-gnu: 1.33.0
+      lightningcss-linux-arm64-musl: 1.33.0
+      lightningcss-linux-x64-gnu: 1.33.0
+      lightningcss-linux-x64-musl: 1.33.0
+      lightningcss-win32-arm64-msvc: 1.33.0
+      lightningcss-win32-x64-msvc: 1.33.0
+    optional: true
+
+  minimist@1.2.8: {}
+
+  nanoid@3.3.18: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@4.0.7: {}
+
+  postcss@8.5.26:
+    dependencies:
+      nanoid: 3.3.18
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  rollup@4.63.1:
+    dependencies:
+      '@types/estree': 1.0.9
+    optionalDependencies:
+      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
+      '@rollup/rollup-android-arm-eabi': 4.63.1
+      '@rollup/rollup-android-arm64': 4.63.1
+      '@rollup/rollup-darwin-arm64': 4.63.1
+      '@rollup/rollup-darwin-x64': 4.63.1
+      '@rollup/rollup-freebsd-arm64': 4.63.1
+      '@rollup/rollup-freebsd-x64': 4.63.1
+      '@rollup/rollup-linux-arm-gnueabihf': 4.63.1
+      '@rollup/rollup-linux-arm-musleabihf': 4.63.1
+      '@rollup/rollup-linux-arm64-gnu': 4.63.1
+      '@rollup/rollup-linux-arm64-musl': 4.63.1
+      '@rollup/rollup-linux-loong64-gnu': 4.63.1
+      '@rollup/rollup-linux-loong64-musl': 4.63.1
+      '@rollup/rollup-linux-ppc64-gnu': 4.63.1
+      '@rollup/rollup-linux-ppc64-musl': 4.63.1
+      '@rollup/rollup-linux-riscv64-gnu': 4.63.1
+      '@rollup/rollup-linux-riscv64-musl': 4.63.1
+      '@rollup/rollup-linux-s390x-gnu': 4.63.1
+      '@rollup/rollup-linux-x64-gnu': 4.63.1
+      '@rollup/rollup-linux-x64-musl': 4.63.1
+      '@rollup/rollup-openbsd-x64': 4.63.1
+      '@rollup/rollup-openharmony-arm64': 4.63.1
+      '@rollup/rollup-win32-arm64-msvc': 4.63.1
+      '@rollup/rollup-win32-ia32-msvc': 4.63.1
+      '@rollup/rollup-win32-x64-gnu': 4.63.1
+      '@rollup/rollup-win32-x64-msvc': 4.63.1
+      fsevents: 2.3.3
+
+  source-map-js@1.2.1: {}
+
+  strip-bom@3.0.0: {}
+
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
+
+  tsconfig-paths@4.2.0:
+    dependencies:
+      json5: 2.2.3
+      minimist: 1.2.8
+      strip-bom: 3.0.0
+
+  vite@7.3.6(lightningcss@1.33.0):
+    dependencies:
+      esbuild: 0.28.2
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
+      postcss: 8.5.26
+      rollup: 4.63.1
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      fsevents: 2.3.3
+      lightningcss: 1.33.0
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..cc10131
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+packages:
+  - npm/*
+
+linkWorkspacePackages: true
+
+onlyBuiltDependencies:
+  - "@swc/core"
+  - esbuild
diff --git a/scripts/build-all.sh b/scripts/build-all.sh
old mode 100644
new mode 100755
index 0277747..6f09f24
--- a/scripts/build-all.sh
+++ b/scripts/build-all.sh
@@ -1,13 +1,11 @@
-#!/bin/bash
-# Build script for all platforms
+#!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-VERSION=${1:-"dev"}
-OUTPUT_DIR="build"
+VERSION=${1:-$(git describe --tags --always --dirty 2>/dev/null || printf 'dev')}
+OUTPUT_DIR=${OUTPUT_DIR:-build}
 
-echo "🏗️  Building OpenCore CLI v${VERSION} for all platforms..."
-echo ""
+printf 'Building OpenCore CLI %s for all platforms...\n' "$VERSION"
 
 # Clean output directory
 rm -rf "$OUTPUT_DIR"
@@ -15,10 +13,11 @@ mkdir -p "$OUTPUT_DIR"
 
 # Build for each platform
 platforms=(
-    "windows/amd64"
+    "linux/amd64"
+    "linux/arm64"
     "darwin/amd64"
     "darwin/arm64"
-    "linux/amd64"
+    "windows/amd64"
 )
 
 for platform in "${platforms[@]}"; do
@@ -30,16 +29,14 @@ for platform in "${platforms[@]}"; do
         output_name="${output_name}.exe"
     fi
     
-    echo "📦 Building for ${GOOS}/${GOARCH}..."
+    printf 'Building for %s/%s...\n' "$GOOS" "$GOARCH"
     
     GOOS="$GOOS" GOARCH="$GOARCH" CGO_ENABLED=0 \
         go build -ldflags "-X main.version=${VERSION}" \
         -o "${OUTPUT_DIR}/${output_name}" \
         .
     
-    echo "✅ ${output_name}"
-    echo ""
+    printf 'Built %s\n' "$output_name"
 done
 
-echo "✨ Build complete! Binaries in ${OUTPUT_DIR}/"
-ls -lh "$OUTPUT_DIR"
+printf 'Build complete: %s/\n' "$OUTPUT_DIR"
diff --git a/scripts/go-test.js b/scripts/go-test.js
new file mode 100755
index 0000000..665a276
--- /dev/null
+++ b/scripts/go-test.js
@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require('node:child_process');
+
+const command = process.platform === 'win32' ? 'go.exe' : 'go';
+const result = spawnSync(command, ['test', '-json', './...'], {
+  encoding: 'utf8',
+  maxBuffer: 64 * 1024 * 1024,
+});
+
+if (result.error) {
+  console.error(`Could not run Go tests: ${result.error.message}`);
+  process.exit(1);
+}
+
+const skipped = [];
+for (const line of result.stdout.split(/\r?\n/)) {
+  if (!line) continue;
+  let event;
+  try {
+    event = JSON.parse(line);
+  } catch {
+    process.stdout.write(`${line}\n`);
+    continue;
+  }
+  if (event.Output) process.stdout.write(event.Output);
+  if (event.Action === 'skip' && event.Test) skipped.push(`${event.Package}: ${event.Test}`);
+}
+if (result.stderr) process.stderr.write(result.stderr);
+
+if (result.status !== 0) process.exit(result.status || 1);
+if (skipped.length > 0) {
+  console.error(`Go tests may not be skipped:\n${skipped.map((test) => `- ${test}`).join('\n')}`);
+  process.exit(1);
+}
diff --git a/scripts/prepare-npm-packages.sh b/scripts/prepare-npm-packages.sh
new file mode 100755
index 0000000..e580cfb
--- /dev/null
+++ b/scripts/prepare-npm-packages.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+build_dir=${1:-build}
+
+copy_binary() {
+  local package_dir=$1
+  local source_binary=$2
+  local package_binary=$3
+
+  mkdir -p "npm/${package_dir}/bin"
+  cp "${build_dir}/${source_binary}" "npm/${package_dir}/bin/${package_binary}"
+  if [[ "${package_binary}" != *.exe ]]; then
+    chmod 755 "npm/${package_dir}/bin/${package_binary}"
+  fi
+}
+
+copy_binary linux-x64 opencore-linux-amd64 opencore
+copy_binary linux-arm64 opencore-linux-arm64 opencore
+copy_binary darwin-x64 opencore-darwin-amd64 opencore
+copy_binary darwin-arm64 opencore-darwin-arm64 opencore
+copy_binary win32-x64 opencore-windows-amd64.exe opencore.exe
diff --git a/scripts/release-check.js b/scripts/release-check.js
new file mode 100755
index 0000000..63ed47c
--- /dev/null
+++ b/scripts/release-check.js
@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs');
+const { spawnSync } = require('node:child_process');
+const path = require('node:path');
+const { checkTag, validateVersions } = require('./version');
+
+const root = path.resolve(__dirname, '..');
+const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+
+try {
+  const tag = process.argv[2] || process.env.GITHUB_REF_NAME || `v${validateVersions(root)}`;
+  checkTag(tag, root);
+  const releaseNotes = fs.readFileSync(path.join(root, 'RELEASE.md'), 'utf8');
+  const escapedTag = tag.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  if (!new RegExp(`^#{1,6}\\s+.*${escapedTag}(?:\\s|$)`, 'mi').test(releaseNotes)) {
+    throw new Error(`RELEASE.md does not contain a heading for ${tag}`);
+  }
+} catch (error) {
+  console.error(`Release preflight failed: ${error.message}`);
+  process.exit(1);
+}
+
+const checks = [
+  [npmCommand, ['test']],
+  [process.execPath, ['scripts/go-test.js']],
+  ['go', ['vet', './...']],
+  [npmCommand, ['pack', '--dry-run']],
+];
+
+for (const [command, args] of checks) {
+  const result = spawnSync(command, args, { cwd: root, stdio: 'inherit' });
+  if (result.error) {
+    console.error(`Release check failed to run ${command}: ${result.error.message}`);
+    process.exit(1);
+  }
+  if (result.status !== 0) process.exit(result.status || 1);
+}
diff --git a/scripts/smoke-npm-packages.js b/scripts/smoke-npm-packages.js
new file mode 100755
index 0000000..39864cb
--- /dev/null
+++ b/scripts/smoke-npm-packages.js
@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const archiveDirectory = path.resolve(process.argv[2] || 'dist/npm');
+const expectedVersion = require('../package.json').version;
+const archives = fs.readdirSync(archiveDirectory)
+  .filter((file) => file.endsWith('.tgz'))
+  .map((file) => path.join(archiveDirectory, file));
+
+if (archives.length !== 6) {
+  throw new Error(`Expected 6 npm tarballs in ${archiveDirectory}, found ${archives.length}`);
+}
+
+const installDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'opencore-npm-smoke-'));
+try {
+  fs.writeFileSync(path.join(installDirectory, 'package.json'), '{"private":true}\n');
+  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+  const install = spawnSync(npm, [
+    'install', '--force', '--ignore-scripts', '--no-audit', '--no-fund', '--package-lock=false', ...archives,
+  ], { cwd: installDirectory, stdio: 'inherit' });
+  if (install.status !== 0) process.exit(install.status || 1);
+
+  const main = require(path.join(installDirectory, 'node_modules/@open-core/cli/package.json'));
+  if (main.version !== expectedVersion) {
+    throw new Error(`Installed main package is ${main.version}, expected ${expectedVersion}`);
+  }
+  for (const name of Object.keys(main.optionalDependencies)) {
+    const platformPackage = require(path.join(installDirectory, 'node_modules', name, 'package.json'));
+    if (platformPackage.version !== expectedVersion) {
+      throw new Error(`${name} is ${platformPackage.version}, expected ${expectedVersion}`);
+    }
+  }
+
+  const executable = process.platform === 'win32'
+    ? path.join(installDirectory, 'node_modules/.bin/opencore.cmd')
+    : path.join(installDirectory, 'node_modules/.bin/opencore');
+  const smoke = spawnSync(executable, ['--version'], { stdio: 'inherit' });
+  if (smoke.status !== 0) process.exit(smoke.status || 1);
+} finally {
+  fs.rmSync(installDirectory, { recursive: true, force: true });
+}
diff --git a/scripts/test-cli.ps1 b/scripts/test-cli.ps1
index 0764021..17e1489 100644
--- a/scripts/test-cli.ps1
+++ b/scripts/test-cli.ps1
@@ -1,76 +1,68 @@
-# Test script for OpenCore CLI
-# Run this to test all commands locally
+$ErrorActionPreference = "Stop"
+Set-StrictMode -Version Latest
+
+function Invoke-Checked {
+    param([scriptblock]$Command, [string]$FailureMessage)
+    & $Command
+    if ($LASTEXITCODE -ne 0) {
+        throw $FailureMessage
+    }
+}
 
 Write-Host "🧪 Testing OpenCore CLI" -ForegroundColor Cyan
 Write-Host ""
 
 # Build CLI
 Write-Host "📦 Building CLI..." -ForegroundColor Yellow
-go build -o opencore.exe ./cmd/opencore
-if ($LASTEXITCODE -ne 0) {
-    Write-Host "❌ Build failed" -ForegroundColor Red
-    exit 1
-}
+Invoke-Checked { go build -o opencore.exe . } "Build failed"
 Write-Host "✅ Build successful" -ForegroundColor Green
 Write-Host ""
 
 # Test version
 Write-Host "📋 Testing version command..." -ForegroundColor Yellow
-.\opencore.exe --version
+Invoke-Checked { .\opencore.exe --version } "Version command failed"
 Write-Host ""
 
 # Test help
 Write-Host "📋 Testing help command..." -ForegroundColor Yellow
-.\opencore.exe --help
+Invoke-Checked { .\opencore.exe --help } "Help command failed"
 Write-Host ""
 
 # Test doctor (will fail if not in OpenCore project)
 Write-Host "📋 Testing doctor command..." -ForegroundColor Yellow
-.\opencore.exe doctor
+& .\opencore.exe doctor
 Write-Host ""
 
 # Create test project
 $testDir = "test-project-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
 Write-Host "📋 Testing init command (creating $testDir)..." -ForegroundColor Yellow
-.\opencore.exe init $testDir
-if ($LASTEXITCODE -ne 0) {
-    Write-Host "❌ Init failed" -ForegroundColor Red
-    exit 1
-}
+Invoke-Checked { .\opencore.exe init $testDir } "Init failed"
 Write-Host "✅ Init successful" -ForegroundColor Green
 Write-Host ""
 
 # Navigate to test project
 Push-Location $testDir
+try {
 
 # Test create feature
 Write-Host "📋 Testing create feature command..." -ForegroundColor Yellow
-..\opencore.exe create feature banking
-if ($LASTEXITCODE -ne 0) {
-    Write-Host "❌ Create feature failed" -ForegroundColor Red
-    Pop-Location
-    exit 1
-}
+Invoke-Checked { ..\opencore.exe create feature banking } "Create feature failed"
 Write-Host "✅ Create feature successful" -ForegroundColor Green
 Write-Host ""
 
 # Test create resource
 Write-Host "📋 Testing create resource command..." -ForegroundColor Yellow
-..\opencore.exe create resource chat --with-client
-if ($LASTEXITCODE -ne 0) {
-    Write-Host "❌ Create resource failed" -ForegroundColor Red
-    Pop-Location
-    exit 1
-}
+Invoke-Checked { ..\opencore.exe create resource chat --with-client } "Create resource failed"
 Write-Host "✅ Create resource successful" -ForegroundColor Green
 Write-Host ""
 
 # Return to original directory
-Pop-Location
+} finally {
+    Pop-Location
+}
 
 Write-Host ""
 Write-Host "✅ All tests passed!" -ForegroundColor Green
 Write-Host ""
 Write-Host "Test project created at: $testDir" -ForegroundColor Cyan
 Write-Host "To clean up: Remove-Item -Recurse -Force $testDir" -ForegroundColor Gray
-
diff --git a/scripts/version.js b/scripts/version.js
new file mode 100755
index 0000000..52fad1a
--- /dev/null
+++ b/scripts/version.js
@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MAIN_PACKAGE = 'package.json';
+const PLATFORM_PACKAGES = [
+  { name: '@open-core/cli-linux-x64', directory: 'npm/linux-x64' },
+  { name: '@open-core/cli-linux-arm64', directory: 'npm/linux-arm64' },
+  { name: '@open-core/cli-darwin-x64', directory: 'npm/darwin-x64' },
+  { name: '@open-core/cli-darwin-arm64', directory: 'npm/darwin-arm64' },
+  { name: '@open-core/cli-win32-x64', directory: 'npm/win32-x64' },
+];
+
+const SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+
+function isValidVersion(version) {
+  return typeof version === 'string' && SEMVER_PATTERN.test(version);
+}
+
+function packageDefinitions() {
+  return [
+    { name: '@open-core/cli', file: MAIN_PACKAGE },
+    ...PLATFORM_PACKAGES.map((platform) => ({
+      name: platform.name,
+      file: path.join(platform.directory, 'package.json'),
+    })),
+  ];
+}
+
+function readJSON(root, file) {
+  return JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
+}
+
+function writeJSON(root, file, value) {
+  fs.writeFileSync(path.join(root, file), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function expectedOptionalDependencies() {
+  return new Set(PLATFORM_PACKAGES.map((platform) => platform.name));
+}
+
+function listNativePackageDirectories(root) {
+  const npmDirectory = path.join(root, 'npm');
+  if (!fs.existsSync(npmDirectory)) {
+    return [];
+  }
+
+  return fs.readdirSync(npmDirectory, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && fs.existsSync(path.join(npmDirectory, entry.name, 'package.json')))
+    .map((entry) => `npm/${entry.name}`)
+    .sort();
+}
+
+function validateVersions(root = process.cwd()) {
+  const definitions = packageDefinitions();
+  const packages = definitions.map((definition) => ({
+    ...definition,
+    value: readJSON(root, definition.file),
+  }));
+  const main = packages[0].value;
+  const expectedNames = expectedOptionalDependencies();
+  const expectedDirectories = new Set(PLATFORM_PACKAGES.map((platform) => platform.directory));
+  const errors = [];
+  const versionLines = packages.map((pkg) => `- ${pkg.value.name || pkg.name}: ${pkg.value.version}`);
+  const versions = new Set(packages.map((pkg) => pkg.value.version));
+
+  if (versions.size !== 1) {
+    errors.push(`Version mismatch:\n${versionLines.join('\n')}`);
+  }
+
+  for (const pkg of packages) {
+    if (pkg.value.name !== pkg.name) {
+      errors.push(`Package name mismatch in ${pkg.file}: ${JSON.stringify(pkg.value.name)}, expected ${pkg.name}`);
+    }
+    if (!isValidVersion(pkg.value.version)) {
+      errors.push(`Invalid version in ${pkg.file}: ${JSON.stringify(pkg.value.version)}`);
+    }
+  }
+
+  const optionalDependencies = main.optionalDependencies || {};
+  for (const name of expectedNames) {
+    if (!(name in optionalDependencies)) {
+      errors.push(`Missing optional dependency: ${name}`);
+    } else if (optionalDependencies[name] !== main.version) {
+      errors.push(`Optional dependency version mismatch: ${name} is ${optionalDependencies[name]}, expected ${main.version}`);
+    }
+  }
+  for (const name of Object.keys(optionalDependencies)) {
+    if (!expectedNames.has(name)) {
+      errors.push(`Unknown optional dependency: ${name}`);
+    }
+  }
+
+  const discoveredDirectories = new Set(listNativePackageDirectories(root));
+  for (const directory of discoveredDirectories) {
+    if (!expectedDirectories.has(directory)) {
+      errors.push(`Native package is not declared: ${directory}`);
+    }
+  }
+  for (const directory of expectedDirectories) {
+    if (!discoveredDirectories.has(directory)) {
+      errors.push(`Native package directory is missing: ${directory}`);
+    }
+  }
+
+  if (errors.length > 0) {
+    throw new Error(errors.join('\n'));
+  }
+
+  return main.version;
+}
+
+function setVersion(version, root = process.cwd()) {
+  if (typeof version !== 'string' || version.startsWith('v') || !isValidVersion(version)) {
+    throw new Error(`Invalid version ${JSON.stringify(version)}. Use a SemVer version without a v prefix.`);
+  }
+
+  const modified = [];
+  for (const definition of packageDefinitions()) {
+    const pkg = readJSON(root, definition.file);
+    let changed = pkg.version !== version;
+    pkg.version = version;
+    if (definition.file === MAIN_PACKAGE) {
+      const optionalDependencies = { ...pkg.optionalDependencies };
+      for (const platform of PLATFORM_PACKAGES) {
+        if (optionalDependencies[platform.name] !== version) {
+          changed = true;
+        }
+        optionalDependencies[platform.name] = version;
+      }
+      pkg.optionalDependencies = optionalDependencies;
+    }
+    if (changed) {
+      writeJSON(root, definition.file, pkg);
+      modified.push(definition.file);
+    }
+  }
+
+  return modified;
+}
+
+function checkTag(tag, root = process.cwd()) {
+  if (typeof tag !== 'string' || !tag.startsWith('v') || !isValidVersion(tag.slice(1))) {
+    throw new Error(`Invalid tag ${JSON.stringify(tag)}. Use v followed by a SemVer version.`);
+  }
+
+  const version = validateVersions(root);
+  if (version !== tag.slice(1)) {
+    throw new Error(`Tag version mismatch: ${tag} does not match package version ${version}`);
+  }
+  return version;
+}
+
+function run(argv = process.argv.slice(2), root = process.cwd()) {
+  const [command, value] = argv;
+  switch (command) {
+    case 'set': {
+      if (!value || argv.length !== 2) {
+        throw new Error('Usage: version.js set <version>');
+      }
+      const modified = setVersion(value, root);
+      if (modified.length === 0) {
+        console.log(`All package versions already use ${value}.`);
+      } else {
+        console.log(`Set version ${value} in:`);
+        for (const file of modified) {
+          console.log(`- ${file}`);
+        }
+      }
+      return;
+    }
+    case 'check':
+      if (argv.length !== 1) {
+        throw new Error('Usage: version.js check');
+      }
+      console.log(`Version check passed: ${validateVersions(root)}`);
+      return;
+    case 'check-tag':
+      if (!value || argv.length !== 2) {
+        throw new Error('Usage: version.js check-tag <tag>');
+      }
+      console.log(`Tag version check passed: ${checkTag(value, root)}`);
+      return;
+    default:
+      throw new Error('Usage: version.js <set|check|check-tag> [version-or-tag]');
+  }
+}
+
+if (require.main === module) {
+  try {
+    run();
+  } catch (error) {
+    console.error(`Version check failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  MAIN_PACKAGE,
+  PLATFORM_PACKAGES,
+  checkTag,
+  isValidVersion,
+  run,
+  setVersion,
+  validateVersions,
+};
diff --git a/test/platform.test.js b/test/platform.test.js
new file mode 100644
index 0000000..e9d5e1c
--- /dev/null
+++ b/test/platform.test.js
@@ -0,0 +1,76 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const { getBinaryPath, getPlatformPackage, run } = require('../platform');
+
+test('selects the native package for every supported platform', () => {
+  assert.deepEqual(getPlatformPackage('linux', 'x64'), {
+    packageName: '@open-core/cli-linux-x64',
+    binary: 'opencore',
+  });
+  assert.deepEqual(getPlatformPackage('linux', 'arm64'), {
+    packageName: '@open-core/cli-linux-arm64',
+    binary: 'opencore',
+  });
+  assert.deepEqual(getPlatformPackage('darwin', 'x64'), {
+    packageName: '@open-core/cli-darwin-x64',
+    binary: 'opencore',
+  });
+  assert.deepEqual(getPlatformPackage('darwin', 'arm64'), {
+    packageName: '@open-core/cli-darwin-arm64',
+    binary: 'opencore',
+  });
+  assert.deepEqual(getPlatformPackage('win32', 'x64'), {
+    packageName: '@open-core/cli-win32-x64',
+    binary: 'opencore.exe',
+  });
+});
+
+test('rejects unsupported platforms', () => {
+  assert.equal(getPlatformPackage('freebsd', 'x64'), null);
+  assert.throws(() => getBinaryPath('freebsd', 'x64'), /Unsupported platform/);
+});
+
+test('explains when the optional platform package is missing', () => {
+  assert.throws(
+    () => getBinaryPath('linux', 'x64', () => { throw new Error('not found'); }),
+    /Missing optional dependency @open-core\/cli-linux-x64/,
+  );
+});
+
+test('passes all arguments and propagates the child exit code', () => {
+  let invocation;
+  const status = run(['build', '--output=plain'], {
+    platform: 'linux',
+    arch: 'x64',
+    resolve: (request) => {
+      assert.equal(request, '@open-core/cli-linux-x64/bin/opencore');
+      return '/packages/opencore';
+    },
+    spawnSync: (binary, args, options) => {
+      invocation = { binary, args, options };
+      return { status: 42 };
+    },
+  });
+
+  assert.equal(status, 42);
+  assert.deepEqual(invocation, {
+    binary: '/packages/opencore',
+    args: ['build', '--output=plain'],
+    options: { stdio: 'inherit', windowsHide: true },
+  });
+});
+
+test('returns an error code without spawning when the platform package is absent', () => {
+  let message = '';
+  const status = run([], {
+    platform: 'win32',
+    arch: 'x64',
+    resolve: () => { throw new Error('not found'); },
+    spawnSync: () => { throw new Error('must not run'); },
+    writeError: (value) => { message = value; },
+  });
+
+  assert.equal(status, 1);
+  assert.match(message, /@open-core\/cli-win32-x64/);
+});
diff --git a/test/version.test.js b/test/version.test.js
new file mode 100644
index 0000000..52f2ea1
--- /dev/null
+++ b/test/version.test.js
@@ -0,0 +1,106 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+
+const {
+  PLATFORM_PACKAGES,
+  checkTag,
+  isValidVersion,
+  setVersion,
+  validateVersions,
+} = require('../scripts/version');
+
+function writeJSON(root, file, value) {
+  const destination = path.join(root, file);
+  fs.mkdirSync(path.dirname(destination), { recursive: true });
+  fs.writeFileSync(destination, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function createFixture(version = '2.0.0-beta.1') {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'opencore-version-'));
+  const optionalDependencies = Object.fromEntries(PLATFORM_PACKAGES.map(({ name }) => [name, version]));
+  writeJSON(root, 'package.json', {
+    name: '@open-core/cli',
+    version,
+    optionalDependencies,
+  });
+  for (const platform of PLATFORM_PACKAGES) {
+    writeJSON(root, `${platform.directory}/package.json`, {
+      name: platform.name,
+      version,
+    });
+  }
+  return root;
+}
+
+function readJSON(root, file) {
+  return JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
+}
+
+test('accepts stable and prerelease SemVer versions', () => {
+  assert.equal(isValidVersion('2.0.0'), true);
+  assert.equal(isValidVersion('2.0.0-beta.2'), true);
+  assert.equal(isValidVersion('2.0.0-beta.2+build.4'), true);
+});
+
+test('rejects invalid versions and a v prefix in set', () => {
+  const root = createFixture();
+  assert.equal(isValidVersion('2.0'), false);
+  assert.equal(isValidVersion('v2.0.0'), false);
+  assert.throws(() => setVersion('v2.0.0', root), /without a v prefix/);
+  assert.throws(() => setVersion('2.0', root), /Invalid version/);
+});
+
+test('set updates every package and optional dependency with final newlines', () => {
+  const root = createFixture();
+  const version = '2.0.0-beta.2';
+  const modified = setVersion(version, root);
+
+  assert.equal(modified.length, 6);
+  assert.equal(validateVersions(root), version);
+  for (const file of ['package.json', ...PLATFORM_PACKAGES.map(({ directory }) => `${directory}/package.json`)]) {
+    assert.equal(fs.readFileSync(path.join(root, file), 'utf8').endsWith('\n'), true);
+  }
+  const main = readJSON(root, 'package.json');
+  for (const { name } of PLATFORM_PACKAGES) {
+    assert.equal(main.optionalDependencies[name], version);
+  }
+});
+
+test('detects a mismatched native package version', () => {
+  const root = createFixture();
+  const file = `${PLATFORM_PACKAGES[0].directory}/package.json`;
+  const pkg = readJSON(root, file);
+  pkg.version = '2.0.0-beta.2';
+  writeJSON(root, file, pkg);
+
+  assert.throws(() => validateVersions(root), /Version mismatch:[\s\S]*cli-linux-x64: 2.0.0-beta.2/);
+});
+
+test('detects missing and unknown optional dependencies', () => {
+  const root = createFixture();
+  const main = readJSON(root, 'package.json');
+  delete main.optionalDependencies[PLATFORM_PACKAGES[0].name];
+  main.optionalDependencies['@open-core/cli-old-platform'] = main.version;
+  writeJSON(root, 'package.json', main);
+
+  assert.throws(() => validateVersions(root), /Missing optional dependency:[\s\S]*Unknown optional dependency/);
+});
+
+test('detects an undeclared native package directory', () => {
+  const root = createFixture();
+  writeJSON(root, 'npm/freebsd-x64/package.json', {
+    name: '@open-core/cli-freebsd-x64',
+    version: '2.0.0-beta.1',
+  });
+
+  assert.throws(() => validateVersions(root), /Native package is not declared: npm\/freebsd-x64/);
+});
+
+test('check-tag accepts a matching tag and rejects a different version', () => {
+  const root = createFixture();
+  assert.equal(checkTag('v2.0.0-beta.1', root), '2.0.0-beta.1');
+  assert.throws(() => checkTag('v2.0.0-beta.2', root), /Tag version mismatch/);
+});