@drawcall/market 0.1.27 → 0.1.29

package/src/schemas.ts

@@ -39,6 +39,11 @@ export const npmDependenciesSchema = z.record(z.string(), z.string()).default({}
 
 export const assetDependenciesSchema = z.record(z.string(), z.string()).default({})
 
+// Maps a skill label to a `skills add` source: a remote ref (owner/repo,
+// git/HTTP URL, tree/<branch>/<subpath>) or a local path to a skill directory
+// shipped inside the asset.
+export const skillDependenciesSchema = z.record(z.string(), z.string()).default({})
+
 export const updateProfileSchema = z.object({
   name: z.string().min(1).max(100).optional(),
   image: z.string().url().optional(),
@@ -66,6 +71,7 @@ export const uploadZipSchema = z.object({
   description: z.string().max(1000).optional(),
   npmDependencies: npmDependenciesSchema,
   assetDependencies: assetDependenciesSchema,
+  skillDependencies: skillDependenciesSchema,
   tags: z.array(z.string()).default([]),
 })
 

package/src/skill.ts

@@ -23,7 +23,7 @@ market preview wooden-chair --out /tmp/wooden-chair.png
 4. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 5. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
 6. \`generate --type <type> "<prompt>"\` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.
-7. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`.
+7. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
 8. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
 
 ## Output
@@ -39,8 +39,11 @@ Installed:
     public/model
     └─ wooden-chair.glb
 - three@^0.178.0 (npm)
+- web-design ← https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)
 Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 \`\`\`
 
+Assets may also declare \`skill\` dependencies, installed for you via the \`skills\` CLI (\`skills add\`) during \`install\`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires \`npx\` to be available.
+
 If search returns no results, try one broader noun phrase. If a command returns \`Error: Not logged in...\`, ask before running \`market login\`.
 `

package/tests/install-layout.test.ts

@@ -30,9 +30,11 @@ test('install writes zip files into the package root', async () => {
           version: '1.0.0',
           npmDependencies: {},
           assetDependencies: {},
+          skillDependencies: {},
         },
       ],
       npmDependencies: {},
+      skillDependencies: {},
     },
     { cwd },
   )
@@ -46,6 +48,7 @@ test('install writes zip files into the package root', async () => {
       },
     ],
     npmDependencies: {},
+    skillDependencies: {},
   })
   assert.equal(
     await fs.readFile(path.join(appRoot, 'public', 'humanoid-animation', 'idle-loop.glb'), 'utf-8'),
@@ -75,9 +78,11 @@ test('install rejects zip paths that escape through parent segments', async () =
             version: '1.0.0',
             npmDependencies: {},
             assetDependencies: {},
+            skillDependencies: {},
           },
         ],
         npmDependencies: {},
+        skillDependencies: {},
       },
       { cwd: tempDir },
     ),
@@ -85,7 +90,60 @@ test('install rejects zip paths that escape through parent segments', async () =
   )
 })
 
-test('findInstallRoot ignores public directories and uses the highest package.json', async () => {
+test('install runs the skills runner per dependency, resolving local paths against the root', async () => {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'market-skills-'))
+  const appRoot = path.join(tempDir, 'app')
+  const cwd = path.join(appRoot, 'src')
+  await fs.mkdir(cwd, { recursive: true })
+  await fs.writeFile(path.join(appRoot, 'package.json'), '{}\n')
+
+  const calls: Array<{ source: string; cwd: string }> = []
+
+  const result = await install(
+    clientWithZip({
+      'public/skills/local-skill/SKILL.md': textEncoder.encode('---\nname: local-skill\n---\n'),
+    }),
+    {
+      assets: [
+        {
+          name: 'with-skills',
+          version: '1.0.0',
+          npmDependencies: {},
+          assetDependencies: {},
+          skillDependencies: {},
+        },
+      ],
+      npmDependencies: {},
+      skillDependencies: {
+        'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+        'local-skill': './public/skills/local-skill',
+      },
+    },
+    {
+      cwd,
+      runSkillAdd: async (source, runnerCwd) => {
+        calls.push({ source, cwd: runnerCwd })
+      },
+    },
+  )
+
+  // Every runner call uses the install root (the dir holding package.json).
+  assert.deepEqual(new Set(calls.map((c) => c.cwd)), new Set([appRoot]))
+
+  const bySource = new Map(calls.map((c) => [c.source, c]))
+  // Remote refs are passed through untouched.
+  assert.ok(bySource.has('vercel-labs/agent-skills/tree/main/skills/web-design-guidelines'))
+  // Local paths are resolved against the install root, not the cwd.
+  assert.ok(bySource.has(path.join(appRoot, 'public', 'skills', 'local-skill')))
+  assert.equal(calls.length, 2)
+
+  assert.deepEqual(result.skillDependencies, {
+    'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+    'local-skill': './public/skills/local-skill',
+  })
+})
+
+test('findInstallRoot uses the nearest package.json, not the monorepo root', async () => {
   const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'market-root-'))
   const repoRoot = path.join(tempDir, 'repo')
   const appRoot = path.join(repoRoot, 'packages', 'app')
@@ -95,7 +153,7 @@ test('findInstallRoot ignores public directories and uses the highest package.js
   await fs.writeFile(path.join(repoRoot, 'package.json'), '{}\n')
   await fs.writeFile(path.join(appRoot, 'package.json'), '{}\n')
 
-  assert.equal(await findInstallRoot(cwd), repoRoot)
+  assert.equal(await findInstallRoot(cwd), appRoot)
 })
 
 test('findInstallRoot falls back to cwd when no package.json exists', async () => {

package/tests/output.test.ts

@@ -18,6 +18,7 @@ test('installResult prints asset and npm lists with a file tree', () => {
         },
       ],
       npmDependencies: { '@react-three/drei': 'latest' },
+      skillDependencies: {},
     }),
     `Installed:
 - wooden-chair@1.2.0 (asset)
@@ -35,3 +36,20 @@ test('installResult prints asset and npm lists with a file tree', () => {
 - @react-three/drei@latest (npm)`,
   )
 })
+
+test('installResult lists installed skills with their source', () => {
+  assert.equal(
+    installResult({
+      assets: [{ name: 'wooden-chair', version: '1.2.0', files: [] }],
+      npmDependencies: {},
+      skillDependencies: {
+        'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+        'local-skill': '/abs/public/skills/local-skill',
+      },
+    }),
+    `Installed:
+- wooden-chair@1.2.0 (asset)
+- local-skill ← /abs/public/skills/local-skill (skill)
+- web-design-guidelines ← vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)`,
+  )
+})

package/tests/resolve-skills.test.ts

@@ -0,0 +1,87 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { resolve, ResolutionError } from '../src/resolve.js'
+
+interface FakeAsset {
+  latestVersion: string
+  approved?: boolean
+  npmDependencies?: Record<string, string>
+  assetDependencies?: Record<string, string>
+  skillDependencies?: Record<string, string>
+}
+
+function clientWith(assets: Record<string, FakeAsset>) {
+  return {
+    exact: async ({ name }: { name: string }) => {
+      const asset = assets[name]
+      if (!asset) return null
+      return {
+        name,
+        latestVersion: asset.latestVersion,
+        approved: asset.approved ?? true,
+        npmDependencies: JSON.stringify(asset.npmDependencies ?? {}),
+        assetDependencies: JSON.stringify(asset.assetDependencies ?? {}),
+        skillDependencies: JSON.stringify(asset.skillDependencies ?? {}),
+      }
+    },
+  } as never
+}
+
+test('resolve collects skill dependencies across transitive assets', async () => {
+  const client = clientWith({
+    root: {
+      latestVersion: '1.0.0',
+      assetDependencies: { dep: '*' },
+      skillDependencies: { 'web-design-guidelines': 'vercel-labs/agent-skills' },
+    },
+    dep: {
+      latestVersion: '2.0.0',
+      skillDependencies: { 'local-skill': './public/skills/local-skill' },
+    },
+  })
+
+  const result = await resolve(client, [{ name: 'root', range: '*' }])
+
+  assert.deepEqual(result.skillDependencies, {
+    'web-design-guidelines': 'vercel-labs/agent-skills',
+    'local-skill': './public/skills/local-skill',
+  })
+})
+
+test('resolve unions identical skill sources without complaint', async () => {
+  const client = clientWith({
+    root: {
+      latestVersion: '1.0.0',
+      assetDependencies: { dep: '*' },
+      skillDependencies: { shared: 'vercel-labs/agent-skills' },
+    },
+    dep: {
+      latestVersion: '1.0.0',
+      skillDependencies: { shared: 'vercel-labs/agent-skills' },
+    },
+  })
+
+  const result = await resolve(client, [{ name: 'root', range: '*' }])
+
+  assert.deepEqual(result.skillDependencies, { shared: 'vercel-labs/agent-skills' })
+})
+
+test('resolve rejects the same skill label with conflicting sources', async () => {
+  const client = clientWith({
+    root: {
+      latestVersion: '1.0.0',
+      assetDependencies: { dep: '*' },
+      skillDependencies: { shared: 'vercel-labs/agent-skills' },
+    },
+    dep: {
+      latestVersion: '1.0.0',
+      skillDependencies: { shared: 'other-org/other-skills' },
+    },
+  })
+
+  await assert.rejects(
+    resolve(client, [{ name: 'root', range: '*' }]),
+    (err: unknown) =>
+      err instanceof ResolutionError && /skill dependency conflict for "shared"/u.test(err.message),
+  )
+})

package/tests/upload-deps.test.ts

@@ -0,0 +1,44 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { parseSkillDeps, parseVersionedDeps } from '../src/commands/upload.js'
+
+test('parseVersionedDeps parses name@range and defaults a missing range to *', () => {
+  assert.deepEqual(parseVersionedDeps(['three@^0.178.0', 'gsap'], 'npm'), {
+    three: '^0.178.0',
+    gsap: '*',
+  })
+})
+
+test('parseVersionedDeps keeps the scope marker on scoped npm packages', () => {
+  assert.deepEqual(parseVersionedDeps(['@react-three/drei@^9.0.0', '@types/node'], 'npm'), {
+    '@react-three/drei': '^9.0.0',
+    '@types/node': '*',
+  })
+})
+
+test('parseVersionedDeps rejects duplicates', () => {
+  assert.throws(() => parseVersionedDeps(['three@^1', 'three@^2'], 'npm'), /Duplicate npm dependency/u)
+})
+
+test('parseSkillDeps splits label=source on the first = only', () => {
+  assert.deepEqual(
+    parseSkillDeps([
+      'web-design=vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+      'local=./public/skills/local',
+    ]),
+    {
+      'web-design': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+      local: './public/skills/local',
+    },
+  )
+})
+
+test('parseSkillDeps rejects specs without a usable label=source', () => {
+  assert.throws(() => parseSkillDeps(['no-separator']), /Use label=source/u)
+  assert.throws(() => parseSkillDeps(['=missing-label']), /Use label=source/u)
+  assert.throws(() => parseSkillDeps(['missing-source=']), /Use label=source/u)
+})
+
+test('parseSkillDeps rejects duplicate labels', () => {
+  assert.throws(() => parseSkillDeps(['a=one', 'a=two']), /Duplicate skill dependency "a"/u)
+})