@drawcall/market 0.1.34 → 0.1.36

package/src/commands/install.ts

@@ -1,6 +1,9 @@
+import * as fs from 'fs/promises'
+import * as path from 'path'
 import ora from 'ora'
 import { resolve } from '../resolve.js'
-import { install as runInstall } from '../install.js'
+import { findInstallRoot, install as runInstall, type InstallRootRequest } from '../install.js'
+import { packageJsonAssetDependencies } from '../package-json.js'
 import { assetNameSchema } from '../schemas.js'
 import { getCliClient } from '../cli-client.js'
 import { installResult } from '../output.js'
@@ -10,42 +13,41 @@ export interface InstallCommandOptions {
   unapproved?: boolean
   cwd?: string
   baseUrl?: string
+  force?: boolean
 }
 
-interface AssetRequest {
-  name: string
-  range: string
-}
+type AssetRequest = InstallRootRequest
 
 export async function installCommand(args: string[], opts: InstallCommandOptions): Promise<void> {
   const { client } = await getCliClient({ baseUrl: opts.baseUrl })
   const includeUnapproved = opts.unapproved ?? false
+  const metadata = await client.asset.installMetadata()
 
   const spinner = ora({
     isEnabled: Boolean(process.stderr.isTTY),
     isSilent: !process.stderr.isTTY,
   }).start()
   try {
-    const requests: AssetRequest[] = []
-    for (const arg of args) {
-      spinner.text = `Resolving "${truncate(arg, 40)}"`
-      requests.push(await resolveArg(client, arg, includeUnapproved))
-    }
+    const requests =
+      args.length > 0
+        ? await resolveArgs(client, args, includeUnapproved, spinner)
+        : await packageJsonRequests(opts.cwd)
 
     spinner.text = 'Resolving dependency tree'
     const resolution = await resolve(client.asset, requests, { includeUnapproved })
 
     const result = await runInstall(client, resolution, {
       cwd: opts.cwd,
+      force: opts.force ?? false,
+      rootRequests: requests,
+      installMetadata: metadata,
       onProgress: (msg) => {
         spinner.text = msg
       },
     })
 
-    const messages = await client.asset.postInstallMessages()
-
     spinner.stop()
-    console.log(installResult(result, messages))
+    console.log(installResult(result, metadata))
   } catch (err) {
     spinner.stop()
     throw err
@@ -72,7 +74,14 @@ export async function resolveArg(
   }
 
   const existing = await client.asset.exact({ name: parsed.name, includeUnapproved })
-  if (existing) return parsed
+  if (existing) {
+    return {
+      name: parsed.name,
+      range: parsed.range,
+      saveRange: parsed.explicitRange ? parsed.range : `^${existing.latestVersion}`,
+      save: true,
+    }
+  }
 
   if (!includeUnapproved) {
     const hidden = await client.asset.exact({ name: parsed.name, includeUnapproved: true })
@@ -89,11 +98,62 @@ export async function resolveArg(
   )
 }
 
-function parseNameAndRange(arg: string): AssetRequest | null {
+async function resolveArgs(
+  client: MarketClient,
+  args: string[],
+  includeUnapproved: boolean,
+  spinner: { text: string },
+): Promise<AssetRequest[]> {
+  const requests: AssetRequest[] = []
+  for (const arg of args) {
+    spinner.text = `Resolving "${truncate(arg, 40)}"`
+    requests.push(await resolveArg(client, arg, includeUnapproved))
+  }
+  return requests
+}
+
+async function packageJsonRequests(cwd: string | undefined): Promise<AssetRequest[]> {
+  const installRoot = await findInstallRoot(cwd ?? process.cwd())
+  const pkgPath = path.join(installRoot, 'package.json')
+  const dependencies = await readPackageJsonAssetDependencies(pkgPath)
+  const requests = Object.entries(dependencies).map(([name, range]) => ({
+    name,
+    range,
+    saveRange: range,
+    save: false,
+  }))
+
+  if (requests.length === 0) {
+    throw new Error(
+      'No assets specified and package.json has no assetDependencies. Pass asset names or add assetDependencies.',
+    )
+  }
+
+  return requests
+}
+
+async function readPackageJsonAssetDependencies(pkgPath: string): Promise<Record<string, string>> {
+  try {
+    return packageJsonAssetDependencies(await fs.readFile(pkgPath, 'utf-8'), pkgPath)
+  } catch (error) {
+    if (isMissingFile(error)) return {}
+    throw error
+  }
+}
+
+function isMissingFile(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
+
+function parseNameAndRange(arg: string):
+  | (Pick<AssetRequest, 'name' | 'range'> & {
+      explicitRange: boolean
+    })
+  | null {
   const atIdx = arg.indexOf('@')
   const name = atIdx >= 0 ? arg.slice(0, atIdx) : arg
   const range = atIdx >= 0 ? arg.slice(atIdx + 1) : '*'
-  return assetNameSchema.safeParse(name).success ? { name, range } : null
+  return assetNameSchema.safeParse(name).success ? { name, range, explicitRange: atIdx >= 0 } : null
 }
 
 function truncate(s: string, max: number): string {

package/src/commands/upload.ts

@@ -1,8 +1,12 @@
 import * as fs from 'fs/promises'
 import * as path from 'path'
+import { unzipSync, zipSync } from 'fflate'
 import ora from 'ora'
 import semver from 'semver'
 import { getCliClient } from '../cli-client.js'
+import { findInstallRoot } from '../install.js'
+import { readMarketLock, sha256 } from '../market-lock.js'
+import { packageJsonAssetDependenciesFromFiles } from '../package-json.js'
 import { MAX_ASSET_DESCRIPTION_LENGTH, MAX_UPLOAD_ZIP_SIZE_BYTES } from '../schemas.js'
 import { unchangedUploadResult, uploadResult } from '../output.js'
 import {
@@ -43,7 +47,7 @@ export async function uploadCommand(
     const parsedDescription = parseUploadDescription(description)
     // Parse dep flags before any network work so a malformed spec fails fast.
     const npmDependencies = parseVersionedDeps(opts.npm ?? [], 'npm')
-    const assetDependencies = parseVersionedDeps(opts.asset ?? [], 'asset')
+    const explicitAssetDependencies = parseVersionedDeps(opts.asset ?? [], 'asset')
     const skillDependencies = parseSkillDeps(opts.skill ?? [])
     const cwd = opts.cwd ?? process.cwd()
     const type = opts.type
@@ -52,8 +56,21 @@ export async function uploadCommand(
     if (zipStat.size >= MAX_UPLOAD_ZIP_SIZE_BYTES) {
       throw new Error('Upload zip must be smaller than 1 GB')
     }
-    const zip = new Uint8Array(await fs.readFile(zipFile))
+    const sourceZip = new Uint8Array(await fs.readFile(zipFile))
     const { client } = await getCliClient({ baseUrl: opts.baseUrl, requireAuth: true })
+    const installMetadata = await client.asset.installMetadata()
+    const typeMetadata = installMetadata[type]
+    const sourceFiles = unzipSync(sourceZip)
+    const packageJsonAssetDependencies = typeMetadata?.readAssetDependenciesFromPackageJson
+      ? packageJsonAssetDependenciesFromFiles(sourceFiles)
+      : {}
+    const assetDependencies = mergeAssetDependencies(
+      packageJsonAssetDependencies,
+      explicitAssetDependencies,
+    )
+    const zip = typeMetadata?.omitUnchangedInstalledFilesOnUpload
+      ? await omitUnchangedInstalledFiles(sourceZip, sourceFiles, assetDependencies, cwd)
+      : sourceZip
     const profile = await client.user.getProfile()
     if (!profile) {
       throw new Error('Not logged in. Run `market login` first.')
@@ -168,6 +185,71 @@ export function parseSkillDeps(specs: string[]): Record<string, string> {
   return out
 }
 
+function mergeAssetDependencies(
+  fromPackageJson: Record<string, string>,
+  explicit: Record<string, string>,
+): Record<string, string> {
+  const merged = { ...fromPackageJson }
+  for (const [name, range] of Object.entries(explicit)) {
+    if (name in merged && merged[name] !== range) {
+      throw new Error(
+        `Conflicting asset dependency "${name}": package.json has ${merged[name]}, --asset has ${range}`,
+      )
+    }
+    merged[name] = range
+  }
+  return merged
+}
+
+async function omitUnchangedInstalledFiles(
+  sourceZip: Uint8Array,
+  sourceFiles: Record<string, Uint8Array>,
+  assetDependencies: Record<string, string>,
+  cwd: string,
+): Promise<Uint8Array> {
+  const dependencyNames = new Set(Object.keys(assetDependencies))
+  if (dependencyNames.size === 0) return sourceZip
+
+  const installRoot = await findInstallRoot(cwd)
+  const lock = await readMarketLock(installRoot)
+  const hashesByPath = new Map<string, string>()
+
+  for (const [name, asset] of Object.entries(lock.assets)) {
+    if (!dependencyNames.has(name)) continue
+    for (const [file, metadata] of Object.entries(asset.files)) {
+      hashesByPath.set(file, metadata.sha256)
+    }
+  }
+
+  if (hashesByPath.size === 0) return sourceZip
+
+  let omitted = false
+  const filtered: Record<string, Uint8Array> = {}
+  for (const [file, content] of Object.entries(sourceFiles)) {
+    const normalizedPath = normalizedZipPath(file)
+    const lockedHash = normalizedPath ? hashesByPath.get(normalizedPath) : undefined
+    if (lockedHash && lockedHash === sha256(content)) {
+      omitted = true
+      continue
+    }
+    filtered[file] = content
+  }
+
+  return omitted ? zipSync(filtered) : sourceZip
+}
+
+function normalizedZipPath(file: string): string | null {
+  const zipPath = file.replace(/\\/g, '/')
+  if (
+    zipPath.split('/').includes('..') ||
+    path.posix.isAbsolute(zipPath) ||
+    path.win32.isAbsolute(zipPath)
+  ) {
+    return null
+  }
+  return path.posix.normalize(zipPath)
+}
+
 /** Compare a stored dependency JSON string against a freshly parsed record. */
 function depsEqual(storedJson: string, next: Record<string, string>): boolean {
   let stored: Record<string, string>

package/src/contract.ts

@@ -74,6 +74,13 @@ export interface GenerateAssetResult {
   version: string
 }
 
+export interface AssetInstallMetadata {
+  installMessage?: string
+  saveOnInstall: boolean
+  readAssetDependenciesFromPackageJson: boolean
+  omitUnchangedInstalledFilesOnUpload: boolean
+}
+
 export const contract = {
   asset: {
     search: oc.input(listAssetsSchema).output(z.custom<PaginatedList<AssetSearchResult>>()),
@@ -95,7 +102,7 @@ export const contract = {
 
     generate: oc.input(generateAssetSchema).output(z.custom<GenerateAssetResult>()),
 
-    postInstallMessages: oc.output(z.custom<Record<string, string>>()),
+    installMetadata: oc.output(z.custom<Record<string, AssetInstallMetadata>>()),
   },
 
   user: {

package/src/index.ts

@@ -9,6 +9,7 @@ export type { AppContract } from './contract.js'
 // Contract output types
 export type {
   Asset,
+  AssetInstallMetadata,
   AssetVersion,
   AssetSearchResult,
   PaginatedList,
@@ -25,6 +26,7 @@ export type {
   AssetSearchInput,
   AssetUploadZipInput,
 } from './asset-implementation.js'
+export { installMetadataForProvider } from './asset-implementation.js'
 
 // Resolve
 export { resolve, ResolutionError } from './resolve.js'
@@ -55,3 +57,10 @@ export type { AssetType } from './schemas.js'
 
 // Constants
 export { MAX_FILE_SIZE, ALLOWED_EXTENSIONS, ASSET_TYPE_LABELS } from './constants.js'
+
+export {
+  packageJsonAssetDependencies,
+  packageJsonAssetDependenciesFromFiles,
+  parsePackageJson,
+} from './package-json.js'
+export type { PackageJson } from './package-json.js'

package/src/install.ts

@@ -16,18 +16,20 @@ import * as path from 'path'
 import { unzipSync } from 'fflate'
 import { detectPackageManager, installDependencies } from 'nypm'
 import type { MarketClient } from './client.js'
+import type { AssetInstallMetadata } from './contract.js'
+import { readMarketLock, sha256, writeMarketLock } from './market-lock.js'
+import { parsePackageJson, type PackageJson } from './package-json.js'
 import type { ResolveResult } from './resolve.js'
 
-interface PackageJson {
-  name?: string
-  private?: boolean
-  dependencies?: Record<string, string>
-  [key: string]: unknown
-}
-
 export interface InstallOptions {
   /** Directory to start project root discovery from (default: cwd) */
   cwd?: string
+  /** Overwrite existing files that differ from the asset zip. */
+  force?: boolean
+  /** Top-level assets requested by the user, used for package.json assetDependencies. */
+  rootRequests?: InstallRootRequest[]
+  /** Asset-type install policy from the Market API. */
+  installMetadata?: Record<string, AssetInstallMetadata>
   /** Log progress */
   onProgress?: (message: string) => void
   /**
@@ -38,6 +40,13 @@ export interface InstallOptions {
   runSkillAdd?: (source: string, cwd: string) => Promise<void>
 }
 
+export interface InstallRootRequest {
+  name: string
+  range: string
+  saveRange: string
+  save: boolean
+}
+
 export interface InstalledAsset {
   name: string
   type: string
@@ -51,6 +60,17 @@ export interface InstallResult {
   npmDependencies: Record<string, string>
   /** Installed skills, keyed by label, with the source passed to `skills add`. */
   skillDependencies: Record<string, string>
+  warnings: string[]
+}
+
+interface DownloadedAsset extends InstalledAsset {
+  fileHashes: Record<string, { sha256: string }>
+}
+
+interface DownloadResult {
+  assets: DownloadedAsset[]
+  wrotePackageJson: boolean
+  warnings: string[]
 }
 
 export async function install(
@@ -60,11 +80,21 @@ export async function install(
 ): Promise<InstallResult> {
   const log = opts.onProgress ?? (() => {})
   const installRoot = await findInstallRoot(opts.cwd ?? process.cwd())
+  const metadata = opts.installMetadata ?? {}
 
-  const [assets] = await Promise.all([
-    downloadAssets(client, resolution, installRoot, log),
-    installNpmDeps(resolution, installRoot, log),
-  ])
+  const download = await downloadAssets(client, resolution, installRoot, {
+    force: opts.force ?? false,
+    log,
+  })
+  await writeInstalledAssetLock(installRoot, download.assets)
+  const packageJsonUpdate = await updatePackageJson(resolution, installRoot, {
+    rootRequests: opts.rootRequests ?? [],
+    installMetadata: metadata,
+    packageManagerNeeded: download.wrotePackageJson,
+  })
+  if (packageJsonUpdate.packageManagerNeeded) {
+    await runPackageManagerInstall(installRoot, log)
+  }
 
   // Skills are installed after asset files land on disk: a skill source may be
   // a local path pointing at a skill directory shipped inside an installed
@@ -77,9 +107,16 @@ export async function install(
   )
 
   return {
-    assets,
+    assets: download.assets.map((asset) => ({
+      name: asset.name,
+      type: asset.type,
+      version: asset.version,
+      description: asset.description,
+      files: asset.files,
+    })),
     npmDependencies: resolution.npmDependencies,
     skillDependencies,
+    warnings: download.warnings,
   }
 }
 
@@ -100,16 +137,22 @@ async function downloadAssets(
   client: MarketClient,
   resolution: ResolveResult,
   projectRoot: string,
-  log: (msg: string) => void,
-): Promise<InstalledAsset[]> {
-  const installedAssets: InstalledAsset[] = []
+  opts: {
+    force: boolean
+    log: (msg: string) => void
+  },
+): Promise<DownloadResult> {
+  const installedAssets: DownloadedAsset[] = []
+  const warnings: string[] = []
+  let wrotePackageJson = false
 
   for (const asset of resolution.assets) {
-    log(`Downloading ${asset.name}@${asset.version}...`)
+    opts.log(`Downloading ${asset.name}@${asset.version}...`)
 
     const zip = await client.asset.downloadZip({ name: asset.name, version: asset.version })
     const files = unzipSync(new Uint8Array(await zip.arrayBuffer()))
     const installedFiles: string[] = []
+    const fileHashes: Record<string, { sha256: string }> = {}
 
     for (const [relativePath, content] of Object.entries(files) as [string, Uint8Array][]) {
       const zipPath = relativePath.replace(/\\/g, '/')
@@ -124,16 +167,31 @@ async function downloadAssets(
       const normalizedPath = path.posix.normalize(zipPath)
       if (
         normalizedPath === '.' ||
-        normalizedPath === 'README.md' ||
+        (normalizedPath === 'README.md' && asset.type !== 'template') ||
         normalizedPath.endsWith('/')
       ) {
         continue
       }
 
       const filePath = path.join(projectRoot, normalizedPath)
-      await fs.mkdir(path.dirname(filePath), { recursive: true })
-      await fs.writeFile(filePath, content)
+      const existing = await maybeReadFile(filePath)
+      if (existing && !bytesEqual(existing, content) && !opts.force) {
+        warnings.push(
+          `Skipped ${normalizedPath} from ${asset.name}@${asset.version}; file already exists. Re-run with --force to overwrite.`,
+        )
+        continue
+      }
+
+      if (!existing || !bytesEqual(existing, content)) {
+        await fs.mkdir(path.dirname(filePath), { recursive: true })
+        await fs.writeFile(filePath, content)
+        if (normalizedPath === 'package.json') {
+          wrotePackageJson = true
+        }
+      }
+
       installedFiles.push(normalizedPath)
+      fileHashes[normalizedPath] = { sha256: sha256(content) }
     }
 
     installedAssets.push({
@@ -142,12 +200,13 @@ async function downloadAssets(
       version: asset.version,
       description: asset.description,
       files: installedFiles,
+      fileHashes,
     })
 
-    log(`Downloaded ${installedFiles.length} files.`)
+    opts.log(`Downloaded ${installedFiles.length} files.`)
   }
 
-  return installedAssets
+  return { assets: installedAssets, wrotePackageJson, warnings }
 }
 
 async function isFile(file: string): Promise<boolean> {
@@ -158,26 +217,60 @@ async function isFile(file: string): Promise<boolean> {
   }
 }
 
-async function installNpmDeps(
+async function maybeReadFile(file: string): Promise<Uint8Array | null> {
+  try {
+    return await fs.readFile(file)
+  } catch (error) {
+    if (isMissingFile(error)) return null
+    throw error
+  }
+}
+
+function isMissingFile(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
+
+async function updatePackageJson(
   resolution: ResolveResult,
   projectRoot: string,
-  log: (msg: string) => void,
-): Promise<void> {
-  const deps = resolution.npmDependencies
-  if (Object.keys(deps).length === 0) return
-
+  opts: {
+    rootRequests: InstallRootRequest[]
+    installMetadata: Record<string, AssetInstallMetadata>
+    packageManagerNeeded: boolean
+  },
+): Promise<{ packageManagerNeeded: boolean }> {
   const pkgPath = path.join(projectRoot, 'package.json')
-  // Only synthesize a package.json when none exists. A malformed existing file
-  // is a real error that must surface — never silently overwrite it.
-  const pkg: PackageJson = (await isFile(pkgPath))
-    ? (JSON.parse(await fs.readFile(pkgPath, 'utf-8')) as PackageJson)
-    : { name: 'my-project', private: true, dependencies: {} }
+  const pkg = (await isFile(pkgPath))
+    ? parsePackageJson(await fs.readFile(pkgPath, 'utf-8'), pkgPath)
+    : defaultPackageJson()
+
+  let changed = false
+  let packageManagerNeeded = opts.packageManagerNeeded
 
-  pkg.dependencies = { ...pkg.dependencies, ...deps }
-  await fs.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n')
+  const npmChanged = mergeRecord(pkg, 'dependencies', resolution.npmDependencies)
+  if (npmChanged) {
+    changed = true
+    packageManagerNeeded = true
+  }
 
-  log(`Installing npm dependencies: ${Object.keys(deps).join(', ')}`)
+  const assetDependencies = assetDependenciesToSave(
+    resolution,
+    opts.rootRequests,
+    opts.installMetadata,
+  )
+  if (mergeRecord(pkg, 'assetDependencies', assetDependencies)) {
+    changed = true
+  }
 
+  if (changed) {
+    await fs.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n')
+  }
+
+  return { packageManagerNeeded }
+}
+
+async function runPackageManagerInstall(projectRoot: string, log: (msg: string) => void) {
+  log('Installing npm dependencies...')
   const pm = await detectPackageManager(projectRoot)
   const pmName = pm?.name ?? 'npm'
 
@@ -186,6 +279,75 @@ async function installNpmDeps(
   log('npm dependencies installed.')
 }
 
+async function writeInstalledAssetLock(
+  projectRoot: string,
+  assets: DownloadedAsset[],
+): Promise<void> {
+  const lock = await readMarketLock(projectRoot)
+  for (const asset of assets) {
+    lock.assets[asset.name] = {
+      version: asset.version,
+      type: asset.type,
+      files: asset.fileHashes,
+    }
+  }
+  await writeMarketLock(projectRoot, lock)
+}
+
+function defaultPackageJson(): PackageJson {
+  return { name: 'my-project', private: true, dependencies: {} }
+}
+
+function mergeRecord(
+  pkg: PackageJson,
+  field: 'dependencies' | 'assetDependencies',
+  values: Record<string, string>,
+): boolean {
+  const entries = Object.entries(values)
+  if (entries.length === 0) return false
+
+  const current = pkg[field] ?? {}
+  let changed = false
+
+  for (const [name, range] of entries) {
+    if (current[name] === range) continue
+    current[name] = range
+    changed = true
+  }
+
+  pkg[field] = current
+  return changed
+}
+
+function assetDependenciesToSave(
+  resolution: ResolveResult,
+  rootRequests: InstallRootRequest[],
+  metadata: Record<string, AssetInstallMetadata>,
+): Record<string, string> {
+  const resolvedByName = new Map(resolution.assets.map((asset) => [asset.name, asset]))
+  const out: Record<string, string> = {}
+
+  for (const request of rootRequests) {
+    if (!request.save) continue
+
+    const asset = resolvedByName.get(request.name)
+    if (!asset) continue
+
+    if ((metadata[asset.type]?.saveOnInstall ?? true) === false) continue
+    out[asset.name] = request.saveRange
+  }
+
+  return out
+}
+
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false
+  for (let i = 0; i < a.length; i += 1) {
+    if (a[i] !== b[i]) return false
+  }
+  return true
+}
+
 async function installSkills(
   resolution: ResolveResult,
   projectRoot: string,