@drawcall/market 0.1.35 → 0.1.37

package/dist/skill.d.ts

@@ -1,2 +1,2 @@
-export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary lines.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\n```\n\n## Workflow\n\n1. Search first unless the user already gave an exact asset name. `search` requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, `environment`, or `flipbook`.\n2. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5 and prints full descriptions.\n3. `install` takes one or more exact asset names (optionally `name@range`); it does not search or generate. Find names with `search` first. No `--type` is needed \u2014 asset names are unique.\n4. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.\n5. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n6. `generate --type <type> \"<prompt>\"` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.\n7. Upload only when publishing is requested: `market upload <name> <zip> \"<description>\" --type <type>`. Declare dependencies with repeatable flags: `--npm name@range`, `--asset name@range`, `--skill label=source`. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip \"A scene\" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.\n8. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n9. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.\n\n## Humanoid animations\n\n`humanoid-animation` assets are single-clip GLBs \u2014 one motion per asset (one idle, one walk-forward, one jump, one attack) on a normalized skeleton that retargets onto any humanoid, whatever its role. A behaving character is therefore a *set* of clips, not one asset: from what the character actually does, budget the clips it needs \u2014 an idle, its locomotion (walk/run, often split by direction: fwd/bwd/left/right), and one clip per distinct action and reaction it performs \u2014 then search for each separately.\n\nSearch one motion per query, named by the motion, because results rank by keyword overlap: a query naming several motions at once is dominated by whichever word matches the most assets and buries the others, so real clips look like a gap when they exist. Names describe the motion, not the character \u2014 so search the motion (`\"walk forward\"`, `\"reload\"`, `\"jump\"`), not the role (`\"player run\"`, `\"boss attack\"`). If a motion finds nothing, retry with synonyms (run/jog/sprint, attack/swing/strike).\n\n## Output\n\nCommands print concise, line-oriented summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled:\n- wooden-chair@1.0.0 (asset)\n  description: Low-poly wooden chair\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\n- three@^0.178.0 (npm)\n- web-design \u2190 https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nAssets may also declare `skill` dependencies, installed for you via the `skills` CLI (`skills add`) during `install`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires `npx` to be available.\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
+export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary lines.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --cwd \"$PWD\"\nmarket list --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\n```\n\n## Workflow\n\n1. In an existing repo, run `list --cwd \"$PWD\"` first to see installed local assets from `.drawcall/market-lock.json`. Use the listed names with `preview <name>` when you want preview images.\n2. Search first unless the user already gave an exact asset name. `search` requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, `environment`, or `flipbook`.\n3. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5 and prints full descriptions.\n4. `install` takes zero or more exact asset names (optionally `name@range`). With names, it installs those assets; with no names, it installs `assetDependencies` from the nearest `package.json`. It does not search or generate. Find names with `search` first. No `--type` is needed \u2014 asset names are unique. Use `--force` only when the user agrees to overwrite changed local files.\n5. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.\n6. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n7. `generate --type <type> \"<prompt>\"` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.\n8. Upload only when publishing is requested: `market upload <name> <zip> \"<description>\" --type <type>`. Declare dependencies with repeatable flags: `--npm name@range`, `--asset name@range`, `--skill label=source`. Template uploads also read root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template upload omits installed dependency files whose hashes still match `.drawcall/market-lock.json`, so edited local files stay in the template. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip \"A scene\" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.\n9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n10. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.\n\n## Humanoid animations\n\n`humanoid-animation` assets are single-clip GLBs \u2014 one motion per asset (one idle, one walk-forward, one jump, one attack) on a normalized skeleton that retargets onto any humanoid, whatever its role. A behaving character is therefore a *set* of clips, not one asset: from what the character actually does, budget the clips it needs \u2014 an idle, its locomotion (walk/run, often split by direction: fwd/bwd/left/right), and one clip per distinct action and reaction it performs \u2014 then search for each separately.\n\nSearch one motion per query, named by the motion, because results rank by keyword overlap: a query naming several motions at once is dominated by whichever word matches the most assets and buries the others, so real clips look like a gap when they exist. Names describe the motion, not the character \u2014 so search the motion (`\"walk forward\"`, `\"reload\"`, `\"jump\"`), not the role (`\"player run\"`, `\"boss attack\"`). If a motion finds nothing, retry with synonyms (run/jog/sprint, attack/swing/strike).\n\n## Output\n\nCommands print concise, line-oriented summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled:\n- wooden-chair@1.0.0 (asset)\n  description: Low-poly wooden chair\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\n- three@^0.178.0 (npm)\n- web-design \u2190 https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)\nInstalled assets: 1\n- wooden-chair@1.0.0 (model)\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nAssets may also declare `skill` dependencies, installed for you via the `skills` CLI (`skills add`) during `install`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires `npx` to be available.\n\nInstalled non-template assets are saved to `package.json.assetDependencies`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in `.drawcall/market-lock.json`.\n\n`list` is offline: it reads `.drawcall/market-lock.json` from the nearest package root and prints exact installed names, versions, types, and installed file paths.\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
 //# sourceMappingURL=skill.d.ts.map

package/dist/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,0qJAwDvB,CAAA"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,81LAmEvB,CAAA"}

package/dist/skill.js

@@ -12,20 +12,22 @@ Use the \`market\` CLI. Keep commands short and read the summary lines.
 \`\`\`sh
 market search "wooden chair" --type model --limit 3
 market install wooden-chair --cwd "$PWD"
+market list --cwd "$PWD"
 market preview wooden-chair --out /tmp/wooden-chair.png
 \`\`\`
 
 ## Workflow
 
-1. Search first unless the user already gave an exact asset name. \`search\` requires \`--type\`; use \`model\` unless the user names another supported type: \`humanoid-model\`, \`texture\`, \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`, \`environment\`, or \`flipbook\`.
-2. Use \`--limit 1\` for lookup, \`--limit 3\` for choice. Search caps at 5 and prints full descriptions.
-3. \`install\` takes one or more exact asset names (optionally \`name@range\`); it does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique.
-4. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
-5. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
-6. \`generate --type <type> "<prompt>"\` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.
-7. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
-8. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
-9. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class and Three.js \`KTX2Loader\` for Basis-compressed files; \`market preview\` fetches the middle frame from the flipbook.
+1. In an existing repo, run \`list --cwd "$PWD"\` first to see installed local assets from \`.drawcall/market-lock.json\`. Use the listed names with \`preview <name>\` when you want preview images.
+2. Search first unless the user already gave an exact asset name. \`search\` requires \`--type\`; use \`model\` unless the user names another supported type: \`humanoid-model\`, \`texture\`, \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`, \`environment\`, or \`flipbook\`.
+3. Use \`--limit 1\` for lookup, \`--limit 3\` for choice. Search caps at 5 and prints full descriptions.
+4. \`install\` takes zero or more exact asset names (optionally \`name@range\`). With names, it installs those assets; with no names, it installs \`assetDependencies\` from the nearest \`package.json\`. It does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique. Use \`--force\` only when the user agrees to overwrite changed local files.
+5. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
+6. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
+7. \`generate --type <type> "<prompt>"\` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.
+8. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template uploads also read root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
+9. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
+10. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class and Three.js \`KTX2Loader\` for Basis-compressed files; \`market preview\` fetches the middle frame from the flipbook.
 
 ## Humanoid animations
 
@@ -48,11 +50,20 @@ Installed:
     └─ wooden-chair.glb
 - three@^0.178.0 (npm)
 - web-design ← https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)
+Installed assets: 1
+- wooden-chair@1.0.0 (model)
+  files:
+    public/model
+    └─ wooden-chair.glb
 Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 \`\`\`
 
 Assets may also declare \`skill\` dependencies, installed for you via the \`skills\` CLI (\`skills add\`) during \`install\`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires \`npx\` to be available.
 
+Installed non-template assets are saved to \`package.json.assetDependencies\`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in \`.drawcall/market-lock.json\`.
+
+\`list\` is offline: it reads \`.drawcall/market-lock.json\` from the nearest package root and prints exact installed names, versions, types, and installed file paths.
+
 If search returns no results, try one broader noun phrase. If a command returns \`Error: Not logged in...\`, ask before running \`market login\`.
 `;
 //# sourceMappingURL=skill.js.map

package/dist/skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwD1B,CAAA"}
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmE1B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawcall/market",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "repository": {
     "type": "git",
     "url": "https://github.com/drawcall-ai/market",
@@ -31,7 +31,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsx src/cli.ts",
-    "test:install-layout": "tsx --test tests/install-layout.test.ts tests/install-command.test.ts",
+    "test:install-layout": "tsx --test tests/install-layout.test.ts tests/install-command.test.ts tests/list-command.test.ts",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {

package/src/asset-implementation.ts

@@ -1,4 +1,5 @@
 import type {
+  AssetInstallMetadata,
   AssetSearchResult,
   AssetVersion,
   GenerateAssetResult,
@@ -6,6 +7,12 @@ import type {
 } from './contract.js'
 import type { AssetType } from './schemas.js'
 
+export const ASSET_RELEVANCE_SCORE: unique symbol = Symbol('assetRelevanceScore')
+
+export interface RankedAssetSearchResult extends AssetSearchResult {
+  [ASSET_RELEVANCE_SCORE]?: number
+}
+
 export interface AssetSearchInput {
   page: number
   limit: number
@@ -45,12 +52,14 @@ export interface AssetGenerateInput {
 
 export interface AssetProvider {
   type: AssetType
-  /**
-   * Shown to the user after an asset of this type is installed. Use it for
-   * type-specific guidance (where files landed, how to use them). Surfaced to
-   * the CLI through the `asset.postInstallMessages` contract procedure.
-   */
-  postInstallMessage?: string
+  /** Shown to the user after an asset of this type is installed. */
+  installMessage?: string
+  /** Whether a top-level install should save this asset to package.json assetDependencies. */
+  saveOnInstall?: boolean
+  /** Whether upload should read package.json assetDependencies from the source zip. */
+  readAssetDependenciesFromPackageJson?: boolean
+  /** Whether upload should omit unchanged installed dependency files from the source zip. */
+  omitUnchangedInstalledFilesOnUpload?: boolean
   search(input: AssetSearchInput): Promise<PaginatedList<AssetSearchResult>>
   exact(input: AssetExactInput): Promise<AssetSearchResult | null>
   uploadZip(input: AssetUploadZipInput, owner: { id: string; role: string }): Promise<AssetVersion>
@@ -59,3 +68,28 @@ export interface AssetProvider {
 }
 
 export type AssetImplementation = AssetProvider
+
+export function assetRelevanceScore(asset: AssetSearchResult): number | undefined {
+  return (asset as RankedAssetSearchResult)[ASSET_RELEVANCE_SCORE]
+}
+
+export function installMetadataForProvider(provider: AssetProvider): AssetInstallMetadata {
+  return {
+    installMessage: provider.installMessage,
+    saveOnInstall: provider.saveOnInstall ?? true,
+    readAssetDependenciesFromPackageJson: provider.readAssetDependenciesFromPackageJson ?? false,
+    omitUnchangedInstalledFilesOnUpload: provider.omitUnchangedInstalledFilesOnUpload ?? false,
+  }
+}
+
+export function withAssetRelevanceScore(
+  asset: AssetSearchResult,
+  score: number,
+): RankedAssetSearchResult {
+  const ranked = { ...asset } as RankedAssetSearchResult
+  Object.defineProperty(ranked, ASSET_RELEVANCE_SCORE, {
+    value: score,
+    enumerable: false,
+  })
+  return ranked
+}

package/src/cli.ts

@@ -9,6 +9,7 @@ import { ASSET_TYPES, type AssetType } from './schemas.js'
 import { installCommand } from './commands/install.js'
 import { searchCommand } from './commands/search.js'
 import { generateCommand } from './commands/generate.js'
+import { listCommand } from './commands/list.js'
 import { previewCommand } from './commands/preview.js'
 import { uploadCommand } from './commands/upload.js'
 import { logout } from './commands/logout.js'
@@ -75,15 +76,32 @@ program
 
 program
   .command('install')
-  .description('Install assets by name')
-  .argument('<assets...>', 'Asset names, optionally with @range')
+  .description('Install assets by name, or package.json assetDependencies when no names are given')
+  .argument('[assets...]', 'Asset names, optionally with @range')
   .addOption(apiOption)
   .option('--unapproved', 'Include unapproved versions', false)
+  .option('--force', 'Overwrite existing files', false)
   .option('--cwd <dir>', 'Project directory')
-  .action(async (args: string[], opts: { api?: string; unapproved: boolean; cwd?: string }) => {
-    await installCommand(args, {
-      baseUrl: opts.api,
-      unapproved: opts.unapproved,
+  .action(
+    async (
+      args: string[],
+      opts: { api?: string; unapproved: boolean; force: boolean; cwd?: string },
+    ) => {
+      await installCommand(args, {
+        baseUrl: opts.api,
+        unapproved: opts.unapproved,
+        force: opts.force,
+        cwd: opts.cwd,
+      })
+    },
+  )
+
+program
+  .command('list')
+  .description('List locally installed assets')
+  .option('--cwd <dir>', 'Project directory')
+  .action(async (opts: { cwd?: string }) => {
+    await listCommand({
       cwd: opts.cwd,
     })
   })

package/src/commands/install.ts

@@ -1,6 +1,9 @@
+import * as fs from 'fs/promises'
+import * as path from 'path'
 import ora from 'ora'
 import { resolve } from '../resolve.js'
-import { install as runInstall } from '../install.js'
+import { findInstallRoot, install as runInstall, type InstallRootRequest } from '../install.js'
+import { packageJsonAssetDependencies } from '../package-json.js'
 import { assetNameSchema } from '../schemas.js'
 import { getCliClient } from '../cli-client.js'
 import { installResult } from '../output.js'
@@ -10,42 +13,41 @@ export interface InstallCommandOptions {
   unapproved?: boolean
   cwd?: string
   baseUrl?: string
+  force?: boolean
 }
 
-interface AssetRequest {
-  name: string
-  range: string
-}
+type AssetRequest = InstallRootRequest
 
 export async function installCommand(args: string[], opts: InstallCommandOptions): Promise<void> {
   const { client } = await getCliClient({ baseUrl: opts.baseUrl })
   const includeUnapproved = opts.unapproved ?? false
+  const metadata = await client.asset.installMetadata()
 
   const spinner = ora({
     isEnabled: Boolean(process.stderr.isTTY),
     isSilent: !process.stderr.isTTY,
   }).start()
   try {
-    const requests: AssetRequest[] = []
-    for (const arg of args) {
-      spinner.text = `Resolving "${truncate(arg, 40)}"`
-      requests.push(await resolveArg(client, arg, includeUnapproved))
-    }
+    const requests =
+      args.length > 0
+        ? await resolveArgs(client, args, includeUnapproved, spinner)
+        : await packageJsonRequests(opts.cwd)
 
     spinner.text = 'Resolving dependency tree'
     const resolution = await resolve(client.asset, requests, { includeUnapproved })
 
     const result = await runInstall(client, resolution, {
       cwd: opts.cwd,
+      force: opts.force ?? false,
+      rootRequests: requests,
+      installMetadata: metadata,
       onProgress: (msg) => {
         spinner.text = msg
       },
     })
 
-    const messages = await client.asset.postInstallMessages()
-
     spinner.stop()
-    console.log(installResult(result, messages))
+    console.log(installResult(result, metadata))
   } catch (err) {
     spinner.stop()
     throw err
@@ -72,7 +74,14 @@ export async function resolveArg(
   }
 
   const existing = await client.asset.exact({ name: parsed.name, includeUnapproved })
-  if (existing) return parsed
+  if (existing) {
+    return {
+      name: parsed.name,
+      range: parsed.range,
+      saveRange: parsed.explicitRange ? parsed.range : `^${existing.latestVersion}`,
+      save: true,
+    }
+  }
 
   if (!includeUnapproved) {
     const hidden = await client.asset.exact({ name: parsed.name, includeUnapproved: true })
@@ -89,11 +98,62 @@ export async function resolveArg(
   )
 }
 
-function parseNameAndRange(arg: string): AssetRequest | null {
+async function resolveArgs(
+  client: MarketClient,
+  args: string[],
+  includeUnapproved: boolean,
+  spinner: { text: string },
+): Promise<AssetRequest[]> {
+  const requests: AssetRequest[] = []
+  for (const arg of args) {
+    spinner.text = `Resolving "${truncate(arg, 40)}"`
+    requests.push(await resolveArg(client, arg, includeUnapproved))
+  }
+  return requests
+}
+
+async function packageJsonRequests(cwd: string | undefined): Promise<AssetRequest[]> {
+  const installRoot = await findInstallRoot(cwd ?? process.cwd())
+  const pkgPath = path.join(installRoot, 'package.json')
+  const dependencies = await readPackageJsonAssetDependencies(pkgPath)
+  const requests = Object.entries(dependencies).map(([name, range]) => ({
+    name,
+    range,
+    saveRange: range,
+    save: false,
+  }))
+
+  if (requests.length === 0) {
+    throw new Error(
+      'No assets specified and package.json has no assetDependencies. Pass asset names or add assetDependencies.',
+    )
+  }
+
+  return requests
+}
+
+async function readPackageJsonAssetDependencies(pkgPath: string): Promise<Record<string, string>> {
+  try {
+    return packageJsonAssetDependencies(await fs.readFile(pkgPath, 'utf-8'), pkgPath)
+  } catch (error) {
+    if (isMissingFile(error)) return {}
+    throw error
+  }
+}
+
+function isMissingFile(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
+
+function parseNameAndRange(arg: string):
+  | (Pick<AssetRequest, 'name' | 'range'> & {
+      explicitRange: boolean
+    })
+  | null {
   const atIdx = arg.indexOf('@')
   const name = atIdx >= 0 ? arg.slice(0, atIdx) : arg
   const range = atIdx >= 0 ? arg.slice(atIdx + 1) : '*'
-  return assetNameSchema.safeParse(name).success ? { name, range } : null
+  return assetNameSchema.safeParse(name).success ? { name, range, explicitRange: atIdx >= 0 } : null
 }
 
 function truncate(s: string, max: number): string {

package/src/commands/list.ts

@@ -0,0 +1,47 @@
+import * as path from 'path'
+import { findInstallRoot } from '../install.js'
+import { MARKET_LOCK_PATH, readMarketLock } from '../market-lock.js'
+import { listResult } from '../output.js'
+
+export interface ListCommandOptions {
+  cwd?: string
+}
+
+export interface InstalledAssetListing {
+  name: string
+  version: string
+  type: string
+  files: string[]
+}
+
+export interface ListInstalledAssetsResult {
+  projectRoot: string
+  lockPath: string
+  assets: InstalledAssetListing[]
+}
+
+export async function listCommand(opts: ListCommandOptions): Promise<void> {
+  const result = await listInstalledAssets(opts.cwd)
+  console.log(listResult(result))
+}
+
+export async function listInstalledAssets(
+  cwd: string | undefined,
+): Promise<ListInstalledAssetsResult> {
+  const projectRoot = await findInstallRoot(cwd ?? process.cwd())
+  const lock = await readMarketLock(projectRoot)
+  const assets = Object.entries(lock.assets)
+    .map(([name, asset]) => ({
+      name,
+      version: asset.version,
+      type: asset.type,
+      files: Object.keys(asset.files).sort((a, b) => a.localeCompare(b)),
+    }))
+    .sort((a, b) => a.name.localeCompare(b.name))
+
+  return {
+    projectRoot,
+    lockPath: path.join(projectRoot, MARKET_LOCK_PATH),
+    assets,
+  }
+}

package/src/commands/upload.ts

@@ -1,8 +1,12 @@
 import * as fs from 'fs/promises'
 import * as path from 'path'
+import { unzipSync, zipSync } from 'fflate'
 import ora from 'ora'
 import semver from 'semver'
 import { getCliClient } from '../cli-client.js'
+import { findInstallRoot } from '../install.js'
+import { readMarketLock, sha256 } from '../market-lock.js'
+import { packageJsonAssetDependenciesFromFiles } from '../package-json.js'
 import { MAX_ASSET_DESCRIPTION_LENGTH, MAX_UPLOAD_ZIP_SIZE_BYTES } from '../schemas.js'
 import { unchangedUploadResult, uploadResult } from '../output.js'
 import {
@@ -43,7 +47,7 @@ export async function uploadCommand(
     const parsedDescription = parseUploadDescription(description)
     // Parse dep flags before any network work so a malformed spec fails fast.
     const npmDependencies = parseVersionedDeps(opts.npm ?? [], 'npm')
-    const assetDependencies = parseVersionedDeps(opts.asset ?? [], 'asset')
+    const explicitAssetDependencies = parseVersionedDeps(opts.asset ?? [], 'asset')
     const skillDependencies = parseSkillDeps(opts.skill ?? [])
     const cwd = opts.cwd ?? process.cwd()
     const type = opts.type
@@ -52,8 +56,21 @@ export async function uploadCommand(
     if (zipStat.size >= MAX_UPLOAD_ZIP_SIZE_BYTES) {
       throw new Error('Upload zip must be smaller than 1 GB')
     }
-    const zip = new Uint8Array(await fs.readFile(zipFile))
+    const sourceZip = new Uint8Array(await fs.readFile(zipFile))
     const { client } = await getCliClient({ baseUrl: opts.baseUrl, requireAuth: true })
+    const installMetadata = await client.asset.installMetadata()
+    const typeMetadata = installMetadata[type]
+    const sourceFiles = unzipSync(sourceZip)
+    const packageJsonAssetDependencies = typeMetadata?.readAssetDependenciesFromPackageJson
+      ? packageJsonAssetDependenciesFromFiles(sourceFiles)
+      : {}
+    const assetDependencies = mergeAssetDependencies(
+      packageJsonAssetDependencies,
+      explicitAssetDependencies,
+    )
+    const zip = typeMetadata?.omitUnchangedInstalledFilesOnUpload
+      ? await omitUnchangedInstalledFiles(sourceZip, sourceFiles, assetDependencies, cwd)
+      : sourceZip
     const profile = await client.user.getProfile()
     if (!profile) {
       throw new Error('Not logged in. Run `market login` first.')
@@ -168,6 +185,71 @@ export function parseSkillDeps(specs: string[]): Record<string, string> {
   return out
 }
 
+function mergeAssetDependencies(
+  fromPackageJson: Record<string, string>,
+  explicit: Record<string, string>,
+): Record<string, string> {
+  const merged = { ...fromPackageJson }
+  for (const [name, range] of Object.entries(explicit)) {
+    if (name in merged && merged[name] !== range) {
+      throw new Error(
+        `Conflicting asset dependency "${name}": package.json has ${merged[name]}, --asset has ${range}`,
+      )
+    }
+    merged[name] = range
+  }
+  return merged
+}
+
+async function omitUnchangedInstalledFiles(
+  sourceZip: Uint8Array,
+  sourceFiles: Record<string, Uint8Array>,
+  assetDependencies: Record<string, string>,
+  cwd: string,
+): Promise<Uint8Array> {
+  const dependencyNames = new Set(Object.keys(assetDependencies))
+  if (dependencyNames.size === 0) return sourceZip
+
+  const installRoot = await findInstallRoot(cwd)
+  const lock = await readMarketLock(installRoot)
+  const hashesByPath = new Map<string, string>()
+
+  for (const [name, asset] of Object.entries(lock.assets)) {
+    if (!dependencyNames.has(name)) continue
+    for (const [file, metadata] of Object.entries(asset.files)) {
+      hashesByPath.set(file, metadata.sha256)
+    }
+  }
+
+  if (hashesByPath.size === 0) return sourceZip
+
+  let omitted = false
+  const filtered: Record<string, Uint8Array> = {}
+  for (const [file, content] of Object.entries(sourceFiles)) {
+    const normalizedPath = normalizedZipPath(file)
+    const lockedHash = normalizedPath ? hashesByPath.get(normalizedPath) : undefined
+    if (lockedHash && lockedHash === sha256(content)) {
+      omitted = true
+      continue
+    }
+    filtered[file] = content
+  }
+
+  return omitted ? zipSync(filtered) : sourceZip
+}
+
+function normalizedZipPath(file: string): string | null {
+  const zipPath = file.replace(/\\/g, '/')
+  if (
+    zipPath.split('/').includes('..') ||
+    path.posix.isAbsolute(zipPath) ||
+    path.win32.isAbsolute(zipPath)
+  ) {
+    return null
+  }
+  return path.posix.normalize(zipPath)
+}
+
 /** Compare a stored dependency JSON string against a freshly parsed record. */
 function depsEqual(storedJson: string, next: Record<string, string>): boolean {
   let stored: Record<string, string>

package/src/contract.ts

@@ -19,6 +19,7 @@ export interface AssetVersion {
   assetDependencies: string
   skillDependencies: string
   sourceKey: string
+  sourceSizeBytes: number | null
   createdAt: Date
 }
 
@@ -45,6 +46,7 @@ export interface AssetSearchResult {
   npmDependencies: string
   assetDependencies: string
   skillDependencies: string
+  sourceSizeBytes: number | null
   /** Public URL of the preview image, or null for types without one. */
   previewUrl: string | null
 }
@@ -74,6 +76,13 @@ export interface GenerateAssetResult {
   version: string
 }
 
+export interface AssetInstallMetadata {
+  installMessage?: string
+  saveOnInstall: boolean
+  readAssetDependenciesFromPackageJson: boolean
+  omitUnchangedInstalledFilesOnUpload: boolean
+}
+
 export const contract = {
   asset: {
     search: oc.input(listAssetsSchema).output(z.custom<PaginatedList<AssetSearchResult>>()),
@@ -95,7 +104,7 @@ export const contract = {
 
     generate: oc.input(generateAssetSchema).output(z.custom<GenerateAssetResult>()),
 
-    postInstallMessages: oc.output(z.custom<Record<string, string>>()),
+    installMetadata: oc.output(z.custom<Record<string, AssetInstallMetadata>>()),
   },
 
   user: {

package/src/index.ts

@@ -9,6 +9,7 @@ export type { AppContract } from './contract.js'
 // Contract output types
 export type {
   Asset,
+  AssetInstallMetadata,
   AssetVersion,
   AssetSearchResult,
   PaginatedList,
@@ -22,9 +23,16 @@ export type {
   AssetGenerateInput,
   AssetImplementation,
   AssetProvider,
+  RankedAssetSearchResult,
   AssetSearchInput,
   AssetUploadZipInput,
 } from './asset-implementation.js'
+export {
+  ASSET_RELEVANCE_SCORE,
+  assetRelevanceScore,
+  installMetadataForProvider,
+  withAssetRelevanceScore,
+} from './asset-implementation.js'
 
 // Resolve
 export { resolve, ResolutionError } from './resolve.js'
@@ -55,3 +63,10 @@ export type { AssetType } from './schemas.js'
 
 // Constants
 export { MAX_FILE_SIZE, ALLOWED_EXTENSIONS, ASSET_TYPE_LABELS } from './constants.js'
+
+export {
+  packageJsonAssetDependencies,
+  packageJsonAssetDependenciesFromFiles,
+  parsePackageJson,
+} from './package-json.js'
+export type { PackageJson } from './package-json.js'