@drawcall/market 0.1.34 → 0.1.36

package/src/market-lock.ts

@@ -0,0 +1,65 @@
+import { createHash } from 'crypto'
+import * as fs from 'fs/promises'
+import * as path from 'path'
+import { z } from 'zod'
+
+export const MARKET_LOCK_PATH = '.drawcall/market-lock.json'
+
+export interface MarketLockAsset {
+  version: string
+  type: string
+  files: Record<string, { sha256: string }>
+}
+
+export interface MarketLock {
+  version: 1
+  assets: Record<string, MarketLockAsset>
+}
+
+const marketLockSchema = z.object({
+  version: z.literal(1),
+  assets: z.record(
+    z.string(),
+    z.object({
+      version: z.string(),
+      type: z.string(),
+      files: z.record(
+        z.string(),
+        z.object({
+          sha256: z.string(),
+        }),
+      ),
+    }),
+  ),
+})
+
+export async function readMarketLock(projectRoot: string): Promise<MarketLock> {
+  const lockPath = path.join(projectRoot, MARKET_LOCK_PATH)
+  try {
+    return marketLockSchema.parse(JSON.parse(await fs.readFile(lockPath, 'utf-8')))
+  } catch (error) {
+    if (isMissingFile(error)) return emptyMarketLock()
+    throw error
+  }
+}
+
+export async function writeMarketLock(projectRoot: string, lock: MarketLock): Promise<void> {
+  const lockPath = path.join(projectRoot, MARKET_LOCK_PATH)
+  await fs.mkdir(path.dirname(lockPath), { recursive: true })
+  await fs.writeFile(lockPath, JSON.stringify(lock, null, 2) + '\n')
+}
+
+export function emptyMarketLock(): MarketLock {
+  return {
+    version: 1,
+    assets: {},
+  }
+}
+
+export function sha256(bytes: Uint8Array): string {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+function isMissingFile(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}

package/src/output.ts

@@ -1,4 +1,4 @@
-import type { AssetSearchResult } from './contract.js'
+import type { AssetInstallMetadata, AssetSearchResult } from './contract.js'
 import type { InstallResult } from './install.js'
 
 export function assetVersionRef(name: string, version?: string): string {
@@ -33,7 +33,7 @@ export function assetSearchResultLine(item: AssetSearchResult): string {
 
 export function installResult(
   result: InstallResult,
-  postInstallMessages: Record<string, string> = {},
+  installMetadata: Record<string, AssetInstallMetadata> = {},
 ): string {
   const npmDependencies = Object.entries(result.npmDependencies)
 
@@ -48,7 +48,7 @@ export function installResult(
     if (files.length > 0) {
       lines.push('  files:', ...indent(fileTree(files), '    '))
     }
-    const message = postInstallMessages[asset.type]
+    const message = installMetadata[asset.type]?.installMessage
     if (message) {
       lines.push(...block('  note: ', message))
     }
@@ -71,6 +71,10 @@ export function installResult(
     )
   }
 
+  if (result.warnings.length > 0) {
+    lines.push('Warnings:', ...result.warnings.map((warning) => `- ${warning}`))
+  }
+
   return lines.join('\n')
 }
 

package/src/package-json.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod'
+
+export interface PackageJson {
+  name?: string
+  private?: boolean
+  dependencies?: Record<string, string>
+  assetDependencies?: Record<string, string>
+  [key: string]: unknown
+}
+
+const stringRecordSchema = z.record(z.string(), z.string())
+
+export function packageJsonAssetDependenciesFromFiles(
+  files: Record<string, Uint8Array>,
+): Record<string, string> {
+  const bytes = files['package.json']
+  if (!bytes) return {}
+
+  return packageJsonAssetDependencies(new TextDecoder().decode(bytes), 'package.json')
+}
+
+export function packageJsonAssetDependencies(json: string, source: string): Record<string, string> {
+  const parsed = parsePackageJson(json, source)
+  const dependencies = parsed.assetDependencies
+  if (dependencies === undefined) return {}
+
+  return stringRecordSchema.parse(dependencies)
+}
+
+export function parsePackageJson(json: string, source: string): PackageJson {
+  const parsed = JSON.parse(json) as unknown
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error(`${source} must contain a JSON object`)
+  }
+
+  return parsed as PackageJson
+}

package/src/skill.ts

@@ -19,13 +19,13 @@ market preview wooden-chair --out /tmp/wooden-chair.png
 
 1. Search first unless the user already gave an exact asset name. \`search\` requires \`--type\`; use \`model\` unless the user names another supported type: \`humanoid-model\`, \`texture\`, \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`, \`environment\`, or \`flipbook\`.
 2. Use \`--limit 1\` for lookup, \`--limit 3\` for choice. Search caps at 5 and prints full descriptions.
-3. \`install\` takes one or more exact asset names (optionally \`name@range\`); it does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique.
+3. \`install\` takes zero or more exact asset names (optionally \`name@range\`). With names, it installs those assets; with no names, it installs \`assetDependencies\` from the nearest \`package.json\`. It does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique. Use \`--force\` only when the user agrees to overwrite changed local files.
 4. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 5. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
 6. \`generate --type <type> "<prompt>"\` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.
-7. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
+7. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template uploads also read root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
 8. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
-9. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class; \`market preview\` fetches the middle frame from the flipbook.
+9. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class and Three.js \`KTX2Loader\` for Basis-compressed files; \`market preview\` fetches the middle frame from the flipbook.
 
 ## Humanoid animations
 
@@ -53,5 +53,7 @@ Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 
 Assets may also declare \`skill\` dependencies, installed for you via the \`skills\` CLI (\`skills add\`) during \`install\`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires \`npx\` to be available.
 
+Installed non-template assets are saved to \`package.json.assetDependencies\`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in \`.drawcall/market-lock.json\`.
+
 If search returns no results, try one broader noun phrase. If a command returns \`Error: Not logged in...\`, ask before running \`market login\`.
 `

package/tests/install-command.test.ts

@@ -31,7 +31,29 @@ test('resolveArg keeps explicit versioned refs exact when the asset exists', asy
 
   const request = await resolveArg(client, 'fresh-sky@1.2.3', false)
 
-  assert.deepEqual(request, { name: 'fresh-sky', range: '1.2.3' })
+  assert.deepEqual(request, {
+    name: 'fresh-sky',
+    range: '1.2.3',
+    saveRange: '1.2.3',
+    save: true,
+  })
+})
+
+test('resolveArg saves an implicit range from the selected latest version', async () => {
+  const client = {
+    asset: {
+      exact: async () => ({ name: 'fresh-sky', latestVersion: '1.2.3', approved: true }),
+    },
+  } as never
+
+  const request = await resolveArg(client, 'fresh-sky', false)
+
+  assert.deepEqual(request, {
+    name: 'fresh-sky',
+    range: '*',
+    saveRange: '^1.2.3',
+    save: true,
+  })
 })
 
 test('resolveArg errors when the asset does not exist instead of deferring', async () => {

package/tests/install-layout.test.ts

@@ -5,6 +5,7 @@ import * as path from 'node:path'
 import test from 'node:test'
 import { zipSync } from 'fflate'
 import { findInstallRoot, install } from '../src/install.js'
+import { MARKET_LOCK_PATH } from '../src/market-lock.js'
 
 const textEncoder = new TextEncoder()
 
@@ -53,6 +54,7 @@ test('install writes zip files into the package root', async () => {
     ],
     npmDependencies: {},
     skillDependencies: {},
+    warnings: [],
   })
   assert.equal(
     await fs.readFile(path.join(appRoot, 'public', 'humanoid-animation', 'idle-loop.glb'), 'utf-8'),
@@ -64,6 +66,15 @@ test('install writes zip files into the package root', async () => {
   )
   assert.equal(await fs.readFile(path.join(appRoot, 'README.md'), 'utf-8'), 'project readme\n')
   assert.equal(await exists(path.join(cwd, 'src', 'idle-loop', 'public')), false)
+
+  const lock = JSON.parse(await fs.readFile(path.join(appRoot, MARKET_LOCK_PATH), 'utf-8')) as {
+    assets: Record<string, { version: string; files: Record<string, { sha256: string }> }>
+  }
+  assert.equal(lock.assets['idle-loop'].version, '1.0.0')
+  assert.equal(
+    typeof lock.assets['idle-loop'].files['public/humanoid-animation/idle-loop.glb'].sha256,
+    'string',
+  )
 })
 
 test('install rejects zip paths that escape through parent segments', async () => {
@@ -149,6 +160,112 @@ test('install runs the skills runner per dependency, resolving local paths again
     'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
     'local-skill': './public/skills/local-skill',
   })
+  assert.deepEqual(result.warnings, [])
+})
+
+test('install saves top-level assets according to provider policy', async () => {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'market-save-policy-'))
+  await fs.writeFile(path.join(tempDir, 'package.json'), '{}\n')
+
+  await install(
+    clientWithZip({
+      'public/model/chair.glb': textEncoder.encode('chair'),
+      'src/template.ts': textEncoder.encode('export {}\n'),
+    }),
+    {
+      assets: [
+        {
+          name: 'chair',
+          type: 'model',
+          version: '1.2.0',
+          description: null,
+          npmDependencies: {},
+          assetDependencies: {},
+          skillDependencies: {},
+        },
+        {
+          name: 'starter-template',
+          type: 'template',
+          version: '2.0.0',
+          description: null,
+          npmDependencies: {},
+          assetDependencies: {},
+          skillDependencies: {},
+        },
+      ],
+      npmDependencies: {},
+      skillDependencies: {},
+    },
+    {
+      cwd: tempDir,
+      rootRequests: [
+        { name: 'chair', range: '*', saveRange: '^1.2.0', save: true },
+        { name: 'starter-template', range: '*', saveRange: '^2.0.0', save: true },
+      ],
+      installMetadata: {
+        template: {
+          saveOnInstall: false,
+          readAssetDependenciesFromPackageJson: true,
+          omitUnchangedInstalledFilesOnUpload: true,
+        },
+      },
+    },
+  )
+
+  const pkg = JSON.parse(await fs.readFile(path.join(tempDir, 'package.json'), 'utf-8')) as {
+    assetDependencies: Record<string, string>
+  }
+  assert.deepEqual(pkg.assetDependencies, { chair: '^1.2.0' })
+})
+
+test('install skips existing changed files unless force is set', async () => {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'market-conflict-'))
+  await fs.mkdir(path.join(tempDir, 'public', 'model'), { recursive: true })
+  await fs.writeFile(path.join(tempDir, 'package.json'), '{}\n')
+  await fs.writeFile(path.join(tempDir, 'public', 'model', 'chair.glb'), 'local edit')
+
+  const resolution = {
+    assets: [
+      {
+        name: 'chair',
+        type: 'model',
+        version: '1.0.0',
+        description: null,
+        npmDependencies: {},
+        assetDependencies: {},
+        skillDependencies: {},
+      },
+    ],
+    npmDependencies: {},
+    skillDependencies: {},
+  }
+
+  const skipped = await install(
+    clientWithZip({
+      'public/model/chair.glb': textEncoder.encode('market bytes'),
+    }),
+    resolution,
+    { cwd: tempDir },
+  )
+
+  assert.equal(await fs.readFile(path.join(tempDir, 'public', 'model', 'chair.glb'), 'utf-8'), 'local edit')
+  assert.match(skipped.warnings[0], /Skipped public\/model\/chair\.glb/u)
+  assert.deepEqual(skipped.assets[0].files, [])
+
+  const forced = await install(
+    clientWithZip({
+      'public/model/chair.glb': textEncoder.encode('market bytes'),
+    }),
+    resolution,
+    { cwd: tempDir, force: true },
+  )
+
+  assert.equal(
+    await fs.readFile(path.join(tempDir, 'public', 'model', 'chair.glb'), 'utf-8'),
+    'market bytes',
+  )
+  assert.deepEqual(forced.warnings, [])
+  assert.deepEqual(forced.assets[0].files, ['public/model/chair.glb'])
 })
 
 test('findInstallRoot uses the nearest package.json, not the monorepo root', async () => {

package/tests/output.test.ts

@@ -47,6 +47,7 @@ test('installResult prints asset type, file tree, and npm list', () => {
       ],
       npmDependencies: { '@react-three/drei': 'latest' },
       skillDependencies: {},
+      warnings: [],
     }),
     `Installed:
 - wooden-chair@1.2.0 (model)
@@ -87,9 +88,15 @@ test('installResult attaches each post-install note under its asset', () => {
         ],
         npmDependencies: {},
         skillDependencies: {},
+        warnings: [],
       },
       {
-        model: 'Load the model.',
+        model: {
+          installMessage: 'Load the model.',
+          saveOnInstall: true,
+          readAssetDependenciesFromPackageJson: false,
+          omitUnchangedInstalledFilesOnUpload: false,
+        },
         // sound-effect intentionally omitted -> no note for `beep`.
       },
     ),
@@ -107,8 +114,16 @@ test('installResult word-wraps a long note with a hanging indent', () => {
       assets: [{ name: 'thing', type: 'model', version: '1.0.0', description: null, files: [] }],
       npmDependencies: {},
       skillDependencies: {},
+      warnings: [],
+    },
+    {
+      model: {
+        installMessage: message,
+        saveOnInstall: true,
+        readAssetDependenciesFromPackageJson: false,
+        omitUnchangedInstalledFilesOnUpload: false,
+      },
     },
-    { model: message },
   )
 
   assert.equal(
@@ -137,6 +152,7 @@ test('installResult lists installed skills with their source', () => {
         'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
         'local-skill': '/abs/public/skills/local-skill',
       },
+      warnings: [],
     }),
     `Installed:
 - wooden-chair@1.2.0 (model)
@@ -160,6 +176,7 @@ test('installResult shows each installed asset description', () => {
       ],
       npmDependencies: {},
       skillDependencies: {},
+      warnings: [],
     }),
     `Installed:
 - wooden-chair@1.2.0 (model)