@drawcall/market 0.1.25 → 0.1.27

package/dist/resolve.js

@@ -2,9 +2,10 @@
  * Dependency resolver for market assets.
  *
  * 1. Collects the target assets and all transitive asset dependencies.
- * 2. For each asset, finds a version that satisfies ALL constraints from
- *    every dependent.
- * 3. Merges npm dependency ranges across all resolved assets and checks
+ * 2. For each asset, takes the latest published version and verifies it
+ *    satisfies ALL constraints from every dependent. (Only the latest
+ *    version is resolved; older versions are not considered.)
+ * 3. Intersects npm dependency ranges across all resolved assets and checks
  *    that they are compatible.
  */
 import * as semver from 'semver';
@@ -29,18 +30,22 @@ export async function resolve(client, requests, opts = {}) {
                 throw new ResolutionError(`Asset "${assetName}" not found.`);
             }
             if (!opts.includeUnapproved && !meta.approved) {
-                throw new ResolutionError(`Asset "${assetName}" has no ${opts.includeUnapproved ? '' : 'approved '}versions.`);
+                throw new ResolutionError(`Asset "${assetName}" has no approved versions.`);
             }
+            // The market publishes immutable versions and resolution targets the
+            // latest published version of each asset. A range that excludes the
+            // latest version is therefore unsatisfiable (older versions are not
+            // resolved), which this message makes explicit.
             const assetConstraints = constraints.get(assetName) ?? [];
             if (!assetConstraints.every((c) => semver.satisfies(meta.latestVersion, c.range))) {
                 const constraintDesc = assetConstraints
                     .map((c) => `  ${c.range} (from ${c.from})`)
                     .join('\n');
-                throw new ResolutionError(`No version of "${assetName}" satisfies all constraints:\n${constraintDesc}\n` +
-                    `Available${opts.includeUnapproved ? '' : ' approved'}: ${meta.latestVersion}`);
+                throw new ResolutionError(`The latest${opts.includeUnapproved ? '' : ' approved'} version of "${assetName}" ` +
+                    `(${meta.latestVersion}) does not satisfy all constraints:\n${constraintDesc}`);
             }
-            const npmDeps = JSON.parse(meta.npmDependencies);
-            const assetDeps = JSON.parse(meta.assetDependencies);
+            const npmDeps = parseDependencies(meta.npmDependencies, assetName, 'npm');
+            const assetDeps = parseDependencies(meta.assetDependencies, assetName, 'asset');
             resolved.set(assetName, {
                 name: assetName,
                 version: meta.latestVersion,
@@ -71,6 +76,18 @@ export async function resolve(client, requests, opts = {}) {
         npmDependencies: mergedNpm,
     };
 }
+function parseDependencies(value, assetName, kind) {
+    try {
+        const parsed = JSON.parse(value || '{}');
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // fall through to a clear error below
+    }
+    throw new ResolutionError(`Asset "${assetName}" has malformed ${kind} dependency metadata.`);
+}
 function addConstraint(constraints, name, range, from) {
     const existing = constraints.get(name) ?? [];
     existing.push({ range, from });
@@ -93,7 +110,8 @@ async function fetchMeta(client, cache, name, includeUnapproved) {
 /**
  * Merge npm dependency ranges from all resolved assets.
  * For each package, check that all declared ranges are compatible
- * (using semver.intersects). Return the narrowest range.
+ * (using semver.intersects), then return the single declared range that is a
+ * subset of every other — the true intersection.
  */
 function mergeNpmDependencies(assets) {
     // Collect all ranges per package
@@ -117,17 +135,18 @@ function mergeNpmDependencies(assets) {
                 }
             }
         }
-        // Use the narrowest (most constrained) range.
-        // Simple heuristic: pick the range with the highest minimum version.
-        let narrowest = ranges[0].range;
-        for (const r of ranges.slice(1)) {
-            const minCurrent = semver.minVersion(narrowest);
-            const minNew = semver.minVersion(r.range);
-            if (minCurrent && minNew && semver.gt(minNew, minCurrent)) {
-                narrowest = r.range;
-            }
+        // Use the single declared range that is contained in every other declared
+        // range — the true intersection of all constraints. Picking by "highest
+        // minimum version" is unsound: a range with a higher minimum can also have
+        // a higher (or open) upper bound, silently dropping another dependent's
+        // upper bound. If no single range represents the intersection, it cannot be
+        // expressed as one package.json range, so fail loudly.
+        const narrowest = ranges.find((candidate) => ranges.every((other) => semver.subset(candidate.range, other.range)));
+        if (!narrowest) {
+            throw new ResolutionError(`npm dependency ranges for "${pkg}" overlap but cannot be combined into a single range:\n` +
+                ranges.map((r) => `  ${r.range} (from ${r.from})`).join('\n'));
         }
-        merged[pkg] = narrowest;
+        merged[pkg] = narrowest.range;
     }
     return merged;
 }

package/dist/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAqBhC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAA6B,EAC7B,QAAwB,EACxB,OAAwC,EAAE;IAE1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6C,CAAA;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEtD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnE,CAAC;IAED,IAAI,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACrD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAA;YAC3F,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,eAAe,CAAC,UAAU,SAAS,cAAc,CAAC,CAAA;YAC9D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,eAAe,CACvB,UAAU,SAAS,YAAY,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,WAAW,CACpF,CAAA;YACH,CAAC;YAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;YACzD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClF,MAAM,cAAc,GAAG,gBAAgB;qBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;qBAC3C,IAAI,CAAC,IAAI,CAAC,CAAA;gBACb,MAAM,IAAI,eAAe,CACvB,kBAAkB,SAAS,iCAAiC,cAAc,IAAI;oBAC5E,YAAY,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,aAAa,EAAE,CACjF,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAA2B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACxE,MAAM,SAAS,GAA2B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAE5E,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI,CAAC,aAAa;gBAC3B,eAAe,EAAE,OAAO;gBACxB,iBAAiB,EAAE,SAAS;aAC7B,CAAC,CAAA;YAEF,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;YACrF,CAAC;QACH,CAAC;QAED,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACnD,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACzD,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,eAAe,CACvB,cAAc,SAAS,IAAI,KAAK,CAAC,OAAO,qBAAqB;oBAC3D,GAAG,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,IAAI,IAAI,CACxC,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAErE,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CACpB,WAA2D,EAC3D,IAAY,EACZ,KAAa,EACb,IAAY;IAEZ,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,WAA2D,EAC3D,QAAoC;IAEpC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,MAA6B,EAC7B,KAAqC,EACrC,IAAY,EACZ,iBAA0B;IAE1B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI;QACJ,iBAAiB;KAClB,CAAC,CAAA;IACF,IAAI,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/B,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAAuB;IACnD,iCAAiC;IACjC,MAAM,YAAY,GAAmD,IAAI,GAAG,EAAE,CAAA;IAE9E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;YAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAChE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,+BAA+B;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,eAAe,CACvB,gCAAgC,GAAG,MAAM;wBACvC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK;wBACjD,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAClD,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,qEAAqE;QACrE,IAAI,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YACzC,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC1D,SAAS,GAAG,CAAC,CAAC,KAAK,CAAA;YACrB,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAA;IACzB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAqBhC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAA6B,EAC7B,QAAwB,EACxB,OAAwC,EAAE;IAE1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6C,CAAA;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEtD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnE,CAAC;IAED,IAAI,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACrD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAA;YAC3F,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,eAAe,CAAC,UAAU,SAAS,cAAc,CAAC,CAAA;YAC9D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,eAAe,CAAC,UAAU,SAAS,6BAA6B,CAAC,CAAA;YAC7E,CAAC;YAED,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;YACzD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClF,MAAM,cAAc,GAAG,gBAAgB;qBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;qBAC3C,IAAI,CAAC,IAAI,CAAC,CAAA;gBACb,MAAM,IAAI,eAAe,CACvB,aAAa,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,gBAAgB,SAAS,IAAI;oBACjF,IAAI,IAAI,CAAC,aAAa,wCAAwC,cAAc,EAAE,CACjF,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;YACzE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;YAE/E,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI,CAAC,aAAa;gBAC3B,eAAe,EAAE,OAAO;gBACxB,iBAAiB,EAAE,SAAS;aAC7B,CAAC,CAAA;YAEF,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;YACrF,CAAC;QACH,CAAC;QAED,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACnD,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACzD,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,eAAe,CACvB,cAAc,SAAS,IAAI,KAAK,CAAC,OAAO,qBAAqB;oBAC3D,GAAG,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,IAAI,IAAI,CACxC,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAErE,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,SAAiB,EACjB,IAAqB;IAErB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAY,CAAA;QACnD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAgC,CAAA;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,UAAU,SAAS,mBAAmB,IAAI,uBAAuB,CAAC,CAAA;AAC9F,CAAC;AAED,SAAS,aAAa,CACpB,WAA2D,EAC3D,IAAY,EACZ,KAAa,EACb,IAAY;IAEZ,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,WAA2D,EAC3D,QAAoC;IAEpC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,MAA6B,EAC7B,KAAqC,EACrC,IAAY,EACZ,iBAA0B;IAE1B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI;QACJ,iBAAiB;KAClB,CAAC,CAAA;IACF,IAAI,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/B,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAuB;IACnD,iCAAiC;IACjC,MAAM,YAAY,GAAmD,IAAI,GAAG,EAAE,CAAA;IAE9E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;YAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAChE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,+BAA+B;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,eAAe,CACvB,gCAAgC,GAAG,MAAM;wBACvC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK;wBACjD,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAClD,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,uDAAuD;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CACrE,CAAA;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CACvB,8BAA8B,GAAG,yDAAyD;gBACxF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChE,CAAA;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAA;IAC/B,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/skill.d.ts

@@ -1,2 +1,2 @@
-export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary line plus asset bullets.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --type model --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\n```\n\n## Workflow\n\n1. Search first unless the user gave an exact asset name.\n2. Search requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, or `environment`.\n3. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5.\n4. Use `--verbose` only when the one-line descriptions are not enough.\n5. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n6. Preview before installing when visual fit matters: `market preview <name> --out <file>`. Preview is not supported for `humanoid-animation`, `template`, `sound-effect`, or `background-music`.\n7. Generate only when the user wants a new asset, auth is available, and the requested asset type supports generation. No asset type currently supports generation.\n8. Upload only when publishing is requested.\n9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n\n## Output\n\nCommands print concise summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled 1 asset: wooden-chair@1.0.0\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
+export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary lines.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\n```\n\n## Workflow\n\n1. Search first unless the user already gave an exact asset name. `search` requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, or `environment`.\n2. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5. Add `--verbose` only when the one-line descriptions are not enough.\n3. `install` takes one or more exact asset names (optionally `name@range`); it does not search or generate. Find names with `search` first. No `--type` is needed \u2014 asset names are unique.\n4. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.\n5. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n6. `generate --type <type> \"<prompt>\"` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.\n7. Upload only when publishing is requested: `market upload <name> <zip> \"<description>\" --type <type>`.\n8. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n\n## Output\n\nCommands print concise, line-oriented summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled:\n- wooden-chair@1.0.0 (asset)\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\n- three@^0.178.0 (npm)\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
 //# sourceMappingURL=skill.d.ts.map

package/dist/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,wkEAyCvB,CAAA"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,s6EA6CvB,CAAA"}

package/dist/skill.js

@@ -5,36 +5,40 @@ description: Find, preview, install, generate, and publish Drawcall Market asset
 
 # Drawcall Market
 
-Use the \`market\` CLI. Keep commands short and read the summary line plus asset bullets.
+Use the \`market\` CLI. Keep commands short and read the summary lines.
 
 ## Quick Start
 
 \`\`\`sh
 market search "wooden chair" --type model --limit 3
-market install wooden-chair --type model --cwd "$PWD"
+market install wooden-chair --cwd "$PWD"
 market preview wooden-chair --out /tmp/wooden-chair.png
 \`\`\`
 
 ## Workflow
 
-1. Search first unless the user gave an exact asset name.
-2. Search requires \`--type\`; use \`model\` unless the user names another supported type: \`humanoid-model\`, \`texture\`, \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`, or \`environment\`.
-3. Use \`--limit 1\` for lookup, \`--limit 3\` for choice. Search caps at 5.
-4. Use \`--verbose\` only when the one-line descriptions are not enough.
+1. Search first unless the user already gave an exact asset name. \`search\` requires \`--type\`; use \`model\` unless the user names another supported type: \`humanoid-model\`, \`texture\`, \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`, or \`environment\`.
+2. Use \`--limit 1\` for lookup, \`--limit 3\` for choice. Search caps at 5. Add \`--verbose\` only when the one-line descriptions are not enough.
+3. \`install\` takes one or more exact asset names (optionally \`name@range\`); it does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique.
+4. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 5. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
-6. Preview before installing when visual fit matters: \`market preview <name> --out <file>\`. Preview is not supported for \`humanoid-animation\`, \`template\`, \`sound-effect\`, or \`background-music\`.
-7. Generate only when the user wants a new asset, auth is available, and the requested asset type supports generation. No asset type currently supports generation.
-8. Upload only when publishing is requested.
-9. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
+6. \`generate --type <type> "<prompt>"\` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.
+7. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`.
+8. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
 
 ## Output
 
-Commands print concise summaries:
+Commands print concise, line-oriented summaries:
 
 \`\`\`text
 Results: 2/8 query="wooden chair" type=model approval=approved
 - wooden-chair@1.0.0 | model | approved | Low-poly wooden chair
-Installed 1 asset: wooden-chair@1.0.0
+Installed:
+- wooden-chair@1.0.0 (asset)
+  files:
+    public/model
+    └─ wooden-chair.glb
+- three@^0.178.0 (npm)
 Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 \`\`\`
 

package/dist/skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyC1B,CAAA"}
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6C1B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawcall/market",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "repository": {
     "type": "git",
     "url": "https://github.com/drawcall-ai/market",

package/src/cli-client.ts

@@ -25,8 +25,7 @@ export interface CliClient {
 
 export async function getCliClient(opts: CliClientOptions = {}): Promise<CliClient> {
   const config = await loadConfig()
-  const authToken =
-    process.env.DRAWCALL_AUTH_TOKEN ?? process.env.MARKET_API_KEY ?? config?.authToken
+  const authToken = process.env.DRAWCALL_AUTH_TOKEN ?? config?.authToken
   const baseUrl = opts.baseUrl ?? process.env.MARKET_API_URL ?? config?.baseUrl ?? DEFAULT_BASE_URL
 
   if (opts.requireAuth && !authToken) {

package/src/cli.ts

@@ -56,7 +56,10 @@ program
     const client = createMarketClient({ baseUrl, authToken: token })
     const profile = await client.user.getProfile()
     if (!profile) throw new Error('The Market API did not accept the auth token.')
-    await saveConfig({ authToken: token, baseUrl })
+    // Only pin baseUrl in config when the user explicitly chose one. Persisting
+    // the default would freeze logged-in users to a host the CLI can no longer
+    // change in a future release.
+    await saveConfig(opts.api ? { authToken: token, baseUrl: opts.api } : { authToken: token })
     console.log(loginResult(profile.email, getConfigPath()))
   })
 
@@ -69,25 +72,18 @@ program
 
 program
   .command('install')
-  .description('Install by name or prompt')
-  .argument('<assets...>', 'Names or prompts')
-  .addOption(typeOption)
+  .description('Install assets by name')
+  .argument('<assets...>', 'Asset names, optionally with @range')
   .addOption(apiOption)
   .option('--unapproved', 'Include unapproved versions', false)
   .option('--cwd <dir>', 'Project directory')
-  .action(
-    async (
-      args: string[],
-      opts: { type?: AssetType; api?: string; unapproved: boolean; cwd?: string },
-    ) => {
-      await installCommand(args, {
-        type: opts.type,
-        baseUrl: opts.api,
-        unapproved: opts.unapproved,
-        cwd: opts.cwd,
-      })
-    },
-  )
+  .action(async (args: string[], opts: { api?: string; unapproved: boolean; cwd?: string }) => {
+    await installCommand(args, {
+      baseUrl: opts.api,
+      unapproved: opts.unapproved,
+      cwd: opts.cwd,
+    })
+  })
 
 program
   .command('search')
@@ -109,12 +105,7 @@ program
         verbose: boolean
       },
     ) => {
-      if (!opts.type) {
-        console.error(
-          errorResult(`Search requires --type. Available types: ${ASSET_TYPES.join(', ')}`),
-        )
-        process.exit(1)
-      }
+      requireType(opts.type, 'Search')
       await searchCommand(query, {
         type: opts.type,
         baseUrl: opts.api,
@@ -142,12 +133,7 @@ program
       description: string,
       opts: { type?: AssetType; api?: string; version?: string; cwd?: string },
     ) => {
-      if (!opts.type) {
-        console.error(
-          errorResult(`Upload requires --type. Available types: ${ASSET_TYPES.join(', ')}`),
-        )
-        process.exit(1)
-      }
+      requireType(opts.type, 'Upload')
       await uploadCommand(name, zipFilter, description, {
         type: opts.type,
         version: opts.version,
@@ -162,7 +148,6 @@ program
   .description('Save preview image')
   .argument('<name>', 'Asset name')
   .argument('[version]', 'Semver version')
-  .addOption(typeOption)
   .addOption(apiOption)
   .option('--unapproved', 'Include unapproved versions', false)
   .option('--out <file>', 'Output image path')
@@ -170,10 +155,9 @@ program
     async (
       name: string,
       version: string | undefined,
-      opts: { type?: AssetType; api?: string; unapproved: boolean; out?: string },
+      opts: { api?: string; unapproved: boolean; out?: string },
     ) => {
       await previewCommand(name, version, {
-        type: opts.type,
         baseUrl: opts.api,
         unapproved: opts.unapproved,
         out: opts.out,
@@ -189,6 +173,7 @@ program
   .addOption(apiOption)
   .option('--cwd <dir>', 'Project directory')
   .action(async (description: string, opts: { type?: AssetType; api?: string; cwd?: string }) => {
+    requireType(opts.type, 'Generate')
     await generateCommand(description, {
       type: opts.type,
       baseUrl: opts.api,
@@ -207,6 +192,15 @@ program.parseAsync().catch((err) => {
   process.exit(1)
 })
 
+function requireType(type: AssetType | undefined, command: string): asserts type is AssetType {
+  if (!type) {
+    console.error(
+      errorResult(`${command} requires --type. Available types: ${ASSET_TYPES.join(', ')}`),
+    )
+    process.exit(1)
+  }
+}
+
 function parseSearchLimit(value: string): number {
   const parsed = Number.parseInt(value, 10)
   if (!Number.isInteger(parsed) || parsed < 1) {

package/src/client.ts

@@ -11,7 +11,6 @@ export interface MarketClientOptions {
   baseUrl?: string
   fetch?: typeof globalThis.fetch
   authToken?: string
-  apiKey?: string
 }
 
 function buildHeaders(authToken?: string): Record<string, string> | undefined {
@@ -20,11 +19,10 @@ function buildHeaders(authToken?: string): Record<string, string> | undefined {
 
 export function createMarketClient(opts: MarketClientOptions = {}): MarketClient {
   const baseUrl = opts.baseUrl || DEFAULT_BASE_URL
-  const authToken = opts.authToken ?? opts.apiKey
   const link = new RPCLink({
     url: new URL('/api/rpc', baseUrl).href,
     fetch: opts.fetch,
-    headers: buildHeaders(authToken),
+    headers: buildHeaders(opts.authToken),
   })
   return createORPCClient<MarketClient>(link)
 }

package/src/commands/install.ts

@@ -1,14 +1,12 @@
-import ora, { type Ora } from 'ora'
+import ora from 'ora'
 import { resolve } from '../resolve.js'
 import { install as runInstall } from '../install.js'
-import { generateAndWait } from '../generate.js'
-import { assetNameSchema, type AssetType } from '../schemas.js'
+import { assetNameSchema } from '../schemas.js'
 import { getCliClient } from '../cli-client.js'
-import { compact, generatedInstallResult, installResult } from '../output.js'
+import { installResult } from '../output.js'
 import type { MarketClient } from '../client.js'
 
 export interface InstallCommandOptions {
-  type?: AssetType
   unapproved?: boolean
   cwd?: string
   baseUrl?: string
@@ -20,8 +18,8 @@ interface AssetRequest {
 }
 
 export async function installCommand(args: string[], opts: InstallCommandOptions): Promise<void> {
-  const { client, authToken } = await getCliClient({ baseUrl: opts.baseUrl })
-  const canGenerate = Boolean(authToken)
+  const { client } = await getCliClient({ baseUrl: opts.baseUrl })
+  const includeUnapproved = opts.unapproved ?? false
 
   const spinner = ora({
     isEnabled: Boolean(process.stderr.isTTY),
@@ -31,15 +29,11 @@ export async function installCommand(args: string[], opts: InstallCommandOptions
     const requests: AssetRequest[] = []
     for (const arg of args) {
       spinner.text = `Resolving "${truncate(arg, 40)}"`
-      requests.push(
-        await resolveArg(client, arg, opts.type, spinner, canGenerate, opts.unapproved ?? false),
-      )
+      requests.push(await resolveArg(client, arg, includeUnapproved))
     }
 
     spinner.text = 'Resolving dependency tree'
-    const resolution = await resolve(client.asset, requests, {
-      includeUnapproved: opts.unapproved ?? false,
-    })
+    const resolution = await resolve(client.asset, requests, { includeUnapproved })
 
     const result = await runInstall(client, resolution, {
       cwd: opts.cwd,
@@ -56,82 +50,41 @@ export async function installCommand(args: string[], opts: InstallCommandOptions
   }
 }
 
+/**
+ * Resolve a single `name` or `name@range` argument to an exact asset request.
+ * Asset names are globally unique, so the name fully determines the asset — no
+ * `--type` is needed. install never fuzzy-searches or generates: it points the
+ * caller at `market search` / `market generate` instead, which keeps behavior
+ * predictable for agents.
+ */
 export async function resolveArg(
   client: MarketClient,
   arg: string,
-  type: AssetType | undefined,
-  spinner: Ora,
-  canGenerate: boolean,
   includeUnapproved: boolean,
 ): Promise<AssetRequest> {
   const parsed = parseNameAndRange(arg)
-  if (parsed) {
-    const existing = await client.asset.exact({
-      name: parsed.name,
-      type,
-      includeUnapproved,
-    })
-    if (existing) return parsed
-
-    if (!includeUnapproved) {
-      const hidden = await client.asset.exact({
-        name: parsed.name,
-        type,
-        includeUnapproved: true,
-      })
-      if (hidden) {
-        throw new Error(
-          `Asset "${parsed.name}" exists but has no approved versions. Re-run with \`--unapproved\` if you have access.`,
-        )
-      }
-    }
-
-    if (arg.includes('@')) {
-      return parsed
-    }
+  if (!parsed) {
+    throw new Error(
+      `Invalid asset name "${arg}". Use \`market search --type <type> <query>\` to find assets.`,
+    )
   }
 
-  spinner.text = `Searching "${truncate(arg, 40)}"`
-  const results = await client.asset.search({
-    query: arg,
-    type,
-    includeUnapproved,
-    limit: 1,
-    page: 1,
-    sort: 'relevance',
-  })
-  if (results.items.length > 0) {
-    const hit = results.items[0]
-    if (process.stderr.isTTY) {
-      spinner.info(`Matched "${compact(arg, 48)}" to ${hit.name} (${hit.type})`)
-      spinner.start()
-    }
-    return { name: hit.name, range: '*' }
-  }
+  const existing = await client.asset.exact({ name: parsed.name, includeUnapproved })
+  if (existing) return parsed
 
-  if (!canGenerate) {
-    throw new Error(
-      `No matches for "${arg}". Run \`market login\` to enable auto-generation of missing assets.`,
-    )
+  if (!includeUnapproved) {
+    const hidden = await client.asset.exact({ name: parsed.name, includeUnapproved: true })
+    if (hidden) {
+      throw new Error(
+        `Asset "${parsed.name}" exists but has no approved versions. Re-run with \`--unapproved\` if you have access.`,
+      )
+    }
   }
 
-  spinner.text = `No matches; generating "${truncate(arg, 40)}"`
-  const generated = await generateAndWait(
-    client,
-    { description: arg, type },
-    {
-      onProgress: (msg) => {
-        spinner.text = msg
-      },
-    },
+  throw new Error(
+    `Asset "${parsed.name}" not found. Use \`market search\` to find assets or ` +
+      `\`market generate --type <type>\` to create one.`,
   )
-  if (process.stderr.isTTY) {
-    spinner.info(
-      `${generatedInstallResult(generated.assetName, generated.version)} for "${compact(arg, 48)}"`,
-    )
-    spinner.start()
-  }
-  return { name: generated.assetName, range: generated.version }
 }
 
 function parseNameAndRange(arg: string): AssetRequest | null {

package/src/commands/preview.ts

@@ -3,10 +3,9 @@ import * as path from 'path'
 import ora from 'ora'
 import { getCliClient } from '../cli-client.js'
 import { previewResult } from '../output.js'
-import { assetNameSchema, semverSchema, type AssetType } from '../schemas.js'
+import { assetNameSchema, semverSchema } from '../schemas.js'
 
 export interface PreviewCommandOptions {
-  type?: AssetType
   unapproved?: boolean
   out?: string
   baseUrl?: string
@@ -19,13 +18,10 @@ export async function previewCommand(
 ): Promise<void> {
   const parsedName = assetNameSchema.parse(name)
   const parsedVersion = version ? semverSchema.parse(version) : undefined
-  if (
-    opts.type === 'humanoid-animation' ||
-    opts.type === 'template' ||
-    opts.type === 'sound-effect'
-  ) {
-    throw new Error(`Preview images are not supported for ${opts.type}`)
-  }
+  // The asset name is globally unique, so the server resolves the type. Whether
+  // that type supports preview images is also a server concern: the API checks
+  // for a provider `downloadPreviewImage` capability and returns a clear,
+  // type-specific error rather than us mirroring a list that can drift.
 
   const spinner = ora({
     text: `Resolving preview for ${parsedName}`,
@@ -40,7 +36,6 @@ export async function previewCommand(
       (
         await client.asset.exact({
           name: parsedName,
-          type: opts.type,
           includeUnapproved: opts.unapproved ?? false,
         })
       )?.latestVersion

package/src/config.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 
 const rawConfigSchema = z.object({
   authToken: z.string().min(1).optional(),
-  apiKey: z.string().min(1).optional(),
   baseUrl: z.string().url().optional(),
 })
 
@@ -31,8 +30,9 @@ export async function loadConfig(): Promise<Config | null> {
     const raw = await fs.readFile(configPath(), 'utf-8')
     const parsed = rawConfigSchema.safeParse(JSON.parse(raw))
     if (!parsed.success) return null
-    const authToken = parsed.data.authToken ?? parsed.data.apiKey
-    return authToken ? { authToken, baseUrl: parsed.data.baseUrl } : null
+    return parsed.data.authToken
+      ? { authToken: parsed.data.authToken, baseUrl: parsed.data.baseUrl }
+      : null
   } catch {
     return null
   }
@@ -41,8 +41,14 @@ export async function loadConfig(): Promise<Config | null> {
 export async function saveConfig(config: Config): Promise<void> {
   const dir = configDir()
   await fs.mkdir(dir, { recursive: true })
+  // `mode` on writeFile/mkdir only applies when the path is created, so chmod
+  // explicitly to protect a pre-existing (possibly world-readable) token file
+  // and its directory. A chmod failure means we could not secure the token, so
+  // let it surface rather than silently leaving it exposed.
+  await fs.chmod(dir, 0o700)
   const file = configPath()
   await fs.writeFile(file, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 })
+  await fs.chmod(file, 0o600)
 }
 
 export async function clearConfig(): Promise<boolean> {

package/src/install.ts

@@ -147,19 +147,18 @@ async function installNpmDeps(
   if (Object.keys(deps).length === 0) return
 
   const pkgPath = path.join(projectRoot, 'package.json')
-  let pkg: PackageJson
-  try {
-    pkg = JSON.parse(await fs.readFile(pkgPath, 'utf-8')) as PackageJson
-  } catch {
-    pkg = { name: 'my-project', private: true, dependencies: {} }
-  }
+  // Only synthesize a package.json when none exists. A malformed existing file
+  // is a real error that must surface — never silently overwrite it.
+  const pkg: PackageJson = (await isFile(pkgPath))
+    ? (JSON.parse(await fs.readFile(pkgPath, 'utf-8')) as PackageJson)
+    : { name: 'my-project', private: true, dependencies: {} }
 
   pkg.dependencies = { ...pkg.dependencies, ...deps }
   await fs.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n')
 
   log(`Installing npm dependencies: ${Object.keys(deps).join(', ')}`)
 
-  const pm = await detectPackageManager(projectRoot).catch(() => null)
+  const pm = await detectPackageManager(projectRoot)
   const pmName = pm?.name ?? 'npm'
 
   log(`Using ${pmName}...`)