@drawcall/market 0.1.48 → 0.1.50

package/src/contract.ts

@@ -49,6 +49,8 @@ export interface AssetSearchResult {
   updatedAt: Date
   latestVersion: string
   approved: boolean
+  /** Visibility. `private` assets are owner-only (resolvable only by their owner or an admin). */
+  access: 'public' | 'private'
   npmDependencies: string
   assetDependencies: string
   skillDependencies: string
@@ -73,6 +75,11 @@ export interface User {
   image: string | null
   role: string
   isAdmin: boolean
+  /**
+   * Capability entitlements from the auth service (e.g. `market:private`, `market:generate`). Lets
+   * the frontend gate features (a private-visibility toggle) without re-deriving role logic.
+   */
+  entitledScopes: string[]
   createdAt: Date
   updatedAt: Date
 }

package/src/generate-job.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import { assetTypeSchema } from './schemas.js'
+import { assetAccessSchema, assetTypeSchema } from './schemas.js'
 
 // A long-running generation is exposed to the caller as a job it polls (see `generate` /
 // `generateStatus` in the contract). The market itself keeps NO state between polls: everything
@@ -13,6 +13,10 @@ export const generationJobSchema = z.object({
   providerJobId: z.string().min(1),
   description: z.string().min(1),
   assetName: z.string().min(1),
+  // The resolved visibility to persist when the job finalizes. Carried in the (stateless) jobId so
+  // the finalizing poll sets the same access the caller chose at start. Defaults to public for jobs
+  // minted before this field existed.
+  access: assetAccessSchema.default('public'),
 })
 export type GenerationJob = z.infer<typeof generationJobSchema>
 

package/src/generate.ts

@@ -1,5 +1,5 @@
 import type { MarketClient } from './client.js'
-import type { AssetType } from './schemas.js'
+import type { AssetAccess, AssetType, GenerateJobStatus, GenerateResponse } from './schemas.js'
 
 export class GenerateError extends Error {
   constructor(message: string) {
@@ -11,51 +11,65 @@ export class GenerateError extends Error {
 export interface GenerateInput {
   description: string
   type?: AssetType
+  /** Requested visibility; omitted lets the server resolve it from entitlement. */
+  access?: AssetAccess
 }
 
-export interface GenerateResult {
-  assetName: string
-  version: string
+// How often the CLI polls a running job.
+const POLL_INTERVAL_MS = 4_000
+// How long one `generate` / `generate install` call blocks-and-polls before handing back control.
+// The command does the waiting (the agent never sleeps between checks). When the window elapses the
+// call returns and the caller just runs `generate install <jobId>` again, which picks up the SAME
+// server-side job where this left off — so no asset type needs to be flagged "slow" ahead of time;
+// anything that outlasts one window simply continues on the next call.
+const WINDOW_MS = 120_000
+
+// Start a generation. Fast providers answer `completed` inline; slow, job-based providers answer
+// `pending` with a jobId to poll (see `waitForGeneration` / `generate install`).
+export function startGeneration(
+  client: MarketClient,
+  input: GenerateInput,
+): Promise<GenerateResponse> {
+  return client.asset.generate(input)
 }
 
-export interface GenerateOptions {
-  onProgress?: (message: string) => void
+// One poll of a generation job.
+export function pollGeneration(client: MarketClient, jobId: string): Promise<GenerateJobStatus> {
+  return client.asset.generateStatus({ jobId })
 }
 
-// Poll cadence for a job-based generation. Each poll is a short, independently-retriable request;
-// the client sleeps between them, so no single request is held open for the length of the job (that
-// is exactly the client/proxy-timeout trap the async flow removes). The deadline sits above the
-// slowest provider's own budget (the humanoid model's upstream job runs up to ~10 min).
-const POLL_INTERVAL_MS = 4_000
-const POLL_DEADLINE_MS = 15 * 60_000
+// The bounded outcome of waiting on a job: it settled (completed/failed), or the window elapsed while
+// it was still running.
+export type PollOutcome =
+  | { status: 'completed'; assetName: string; version: string }
+  | { status: 'failed'; error: string }
+  | { status: 'running' }
 
-export async function generateAndWait(
+// Poll a job until it settles or `windowMs` elapses. Bounded so a single call stays under a harness
+// timeout; on timeout it returns `running` (the job keeps going server-side — run again to continue).
+export async function waitForGeneration(
   client: MarketClient,
-  input: GenerateInput,
-  opts: GenerateOptions = {},
-): Promise<GenerateResult> {
+  jobId: string,
+  opts: { windowMs?: number; onProgress?: (message: string) => void } = {},
+): Promise<PollOutcome> {
+  const windowMs = opts.windowMs ?? WINDOW_MS
   const report = opts.onProgress ?? (() => {})
-
-  report('Generating asset')
-  const started = await client.asset.generate(input)
-  if (started.status === 'completed') {
-    return { assetName: started.assetName, version: started.version }
-  }
-
   const startedAt = Date.now()
   for (;;) {
-    if (Date.now() - startedAt > POLL_DEADLINE_MS) {
-      throw new GenerateError('Generation timed out.')
-    }
-    await delay(POLL_INTERVAL_MS)
-    report('Generating asset')
-    const status = await client.asset.generateStatus({ jobId: started.jobId })
+    const status = await pollGeneration(client, jobId)
     if (status.status === 'completed') {
-      return { assetName: status.assetName, version: status.version }
+      return { status: 'completed', assetName: status.assetName, version: status.version }
     }
     if (status.status === 'failed') {
-      throw new GenerateError(status.error)
+      return { status: 'failed', error: status.error }
+    }
+    const remaining = windowMs - (Date.now() - startedAt)
+    if (remaining <= 0) {
+      return { status: 'running' }
     }
+    report('Generating asset')
+    // Trim the last sleep so the call returns as soon as the window passes, not a poll-interval later.
+    await delay(Math.min(POLL_INTERVAL_MS, remaining))
   }
 }
 

package/src/index.ts

@@ -40,8 +40,8 @@ export { resolve, ResolutionError } from './resolve.js'
 export type { ResolvedAsset, ResolveResult } from './resolve.js'
 
 // Generate
-export { generateAndWait, GenerateError } from './generate.js'
-export type { GenerateInput, GenerateResult, GenerateOptions } from './generate.js'
+export { startGeneration, pollGeneration, GenerateError } from './generate.js'
+export type { GenerateInput } from './generate.js'
 
 // Agent
 export { agentAndWait, AgentError } from './agent.js'
@@ -54,6 +54,7 @@ export {
   assetTypeSchema,
   semverSchema,
   assetNameSchema,
+  assetAccessSchema,
   npmDependenciesSchema,
   assetDependenciesSchema,
   skillDependenciesSchema,
@@ -75,6 +76,7 @@ export {
 } from './schemas.js'
 export type {
   AssetType,
+  AssetAccess,
   AgentResultAsset,
   AgentResult,
   AgentRunStatus,

package/src/output.ts

@@ -1,6 +1,7 @@
 import type { AssetInstallMetadata, AssetSearchResult } from './contract.js'
 import type { ListInstalledAssetsResult } from './commands/list.js'
 import type { InstallResult } from './install.js'
+import type { PackedAsset } from './pack.js'
 
 export function assetVersionRef(name: string, version?: string): string {
   return version ? `${name}@${version}` : name
@@ -125,6 +126,20 @@ export function generatedInstallResult(name: string, version: string): string {
   return `Generated and installed ${assetVersionRef(name, version)}`
 }
 
+// Printed when `generate` returns before the job finished: it keeps running server-side and the
+// caller continues it with `generate install`, which installs the asset once it is ready.
+export function generationStartedResult(jobId: string): string {
+  return [
+    'Still generating after a couple of minutes — it continues in the background.',
+    `Run this to pick up where it left off and install when ready:  market generate install ${jobId}`,
+  ].join('\n')
+}
+
+// Printed by `generate install` when the job is still running after its wait window.
+export function generationRunningResult(jobId: string): string {
+  return `Still generating. Run again to continue:  market generate install ${jobId}`
+}
+
 export function uploadResult(name: string, version: string): string {
   return `Uploaded ${assetVersionRef(name, version)}`
 }
@@ -133,6 +148,17 @@ export function unchangedUploadResult(name: string, version: string): string {
   return `No upload needed: ${assetVersionRef(name, version)} is unchanged`
 }
 
+export function packResult(out: string, packed: PackedAsset): string {
+  const lines = [`Packed: ${out}`]
+  if (packed.omittedUnchangedInstalledFiles) {
+    lines.push('Omitted unchanged installed dependency files.')
+  }
+  lines.push(...dependencyLines('npm dependencies', packed.npmDependencies))
+  lines.push(...dependencyLines('asset dependencies', packed.assetDependencies))
+  lines.push(...dependencyLines('skill dependencies', packed.skillDependencies))
+  return lines.join('\n')
+}
+
 export function previewResult(name: string, version: string, out: string): string {
   return `Saved preview for ${assetVersionRef(name, version)}: ${out}`
 }
@@ -204,3 +230,12 @@ function unique<T>(values: T[]): T[] {
 function indent(lines: string[], prefix: string): string[] {
   return lines.map((line) => `${prefix}${line}`)
 }
+
+function dependencyLines(label: string, deps: Record<string, string>): string[] {
+  const entries = Object.entries(deps)
+  if (entries.length === 0) return []
+  return [
+    `${label}:`,
+    ...entries.sort(([a], [b]) => a.localeCompare(b)).map(([name, value]) => `- ${name}: ${value}`),
+  ]
+}

package/src/pack.ts

@@ -0,0 +1,294 @@
+import * as fs from 'fs/promises'
+import * as path from 'path'
+import { unzipSync, zipSync } from 'fflate'
+import type { AssetInstallMetadata } from './contract.js'
+import { findInstallRoot } from './install.js'
+import { readMarketLock, sha256 } from './market-lock.js'
+import {
+  packageJsonAssetDependenciesFromFiles,
+  packageJsonNpmDependenciesFromFiles,
+} from './package-json.js'
+import { MAX_UPLOAD_ZIP_SIZE_BYTES, type AssetType } from './schemas.js'
+
+export interface PackDependencySpecs {
+  npm?: string[]
+  asset?: string[]
+  skill?: string[]
+}
+
+export interface ParsedPackDependencies {
+  npmDependencies: Record<string, string>
+  assetDependencies: Record<string, string>
+  skillDependencies: Record<string, string>
+}
+
+export interface PackPolicy {
+  readPackageJsonDependencies: boolean
+  omitUnchangedInstalledFiles: boolean
+}
+
+export interface PackAssetOptions {
+  cwd?: string
+  dependencies: ParsedPackDependencies
+  policy?: PackPolicy
+}
+
+export interface PackedAsset {
+  sourcePath: string
+  zip: Uint8Array
+  npmDependencies: Record<string, string>
+  assetDependencies: Record<string, string>
+  skillDependencies: Record<string, string>
+  omittedUnchangedInstalledFiles: boolean
+}
+
+export async function packAsset(zipFilter: string, opts: PackAssetOptions): Promise<PackedAsset> {
+  const cwd = opts.cwd ?? process.cwd()
+  const zipFile = await resolveOneZipFile(cwd, zipFilter)
+  const zipStat = await fs.stat(zipFile)
+  if (zipStat.size >= MAX_UPLOAD_ZIP_SIZE_BYTES) {
+    throw new Error('Packed zip must be smaller than 1 GB')
+  }
+
+  const sourceZip = new Uint8Array(await fs.readFile(zipFile))
+  const sourceFiles = unzipSync(sourceZip)
+  const policy = opts.policy ?? inferPackPolicy(sourceFiles)
+  const packageJsonAssetDependencies = policy.readPackageJsonDependencies
+    ? packageJsonAssetDependenciesFromFiles(sourceFiles)
+    : {}
+  const assetDependencies = mergeAssetDependencies(
+    packageJsonAssetDependencies,
+    opts.dependencies.assetDependencies,
+  )
+
+  const packageJsonNpmDependencies = policy.readPackageJsonDependencies
+    ? packageJsonNpmDependenciesFromFiles(sourceFiles)
+    : {}
+  const npmDependencies = { ...packageJsonNpmDependencies, ...opts.dependencies.npmDependencies }
+  const packed = policy.omitUnchangedInstalledFiles
+    ? await omitUnchangedInstalledFiles(sourceZip, sourceFiles, assetDependencies, cwd)
+    : { zip: sourceZip, omitted: false }
+
+  return {
+    sourcePath: zipFile,
+    zip: packed.zip,
+    npmDependencies,
+    assetDependencies,
+    skillDependencies: opts.dependencies.skillDependencies,
+    omittedUnchangedInstalledFiles: packed.omitted,
+  }
+}
+
+export function parsePackDependencies(specs: PackDependencySpecs): ParsedPackDependencies {
+  return {
+    npmDependencies: parseVersionedDeps(specs.npm ?? [], 'npm'),
+    assetDependencies: parseVersionedDeps(specs.asset ?? [], 'asset'),
+    skillDependencies: parseSkillDeps(specs.skill ?? []),
+  }
+}
+
+export function packPolicyForType(type: AssetType | undefined): PackPolicy | undefined {
+  if (!type) return undefined
+  return {
+    readPackageJsonDependencies: type === 'template',
+    omitUnchangedInstalledFiles: type === 'template',
+  }
+}
+
+export function packPolicyFromInstallMetadata(
+  metadata: AssetInstallMetadata | undefined,
+): PackPolicy {
+  return {
+    readPackageJsonDependencies: metadata?.readAssetDependenciesFromPackageJson ?? false,
+    omitUnchangedInstalledFiles: metadata?.omitUnchangedInstalledFilesOnUpload ?? false,
+  }
+}
+
+/**
+ * Parse `name@range` specs (npm or asset deps) into a name→range record. The
+ * range is optional and defaults to `*`. A leading `@` is treated as a scope
+ * marker, so `@scope/pkg@^1.0.0` splits into `@scope/pkg` and `^1.0.0`.
+ */
+export function parseVersionedDeps(specs: string[], kind: 'npm' | 'asset'): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const spec of specs) {
+    const at = spec.lastIndexOf('@')
+    const hasRange = at > 0
+    const name = hasRange ? spec.slice(0, at) : spec
+    const range = hasRange ? spec.slice(at + 1) : '*'
+    if (!name || !range) {
+      throw new Error(`Invalid ${kind} dependency "${spec}". Use name@range (e.g. three@^0.178.0).`)
+    }
+    if (name in out) {
+      throw new Error(`Duplicate ${kind} dependency "${name}".`)
+    }
+    out[name] = range
+  }
+  return out
+}
+
+/**
+ * Parse `label=source` specs into a label→source record. The source is passed
+ * verbatim to `skills add` (a GitHub/git ref or a local path), so only the
+ * first `=` is treated as the separator.
+ */
+export function parseSkillDeps(specs: string[]): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const spec of specs) {
+    const eq = spec.indexOf('=')
+    if (eq <= 0 || eq === spec.length - 1) {
+      throw new Error(
+        `Invalid skill dependency "${spec}". Use label=source ` +
+          `(e.g. web-design=vercel-labs/agent-skills).`,
+      )
+    }
+    const label = spec.slice(0, eq)
+    if (label in out) {
+      throw new Error(`Duplicate skill dependency "${label}".`)
+    }
+    out[label] = spec.slice(eq + 1)
+  }
+  return out
+}
+
+function mergeAssetDependencies(
+  fromPackageJson: Record<string, string>,
+  explicit: Record<string, string>,
+): Record<string, string> {
+  const merged = { ...fromPackageJson }
+  for (const [name, range] of Object.entries(explicit)) {
+    if (name in merged && merged[name] !== range) {
+      throw new Error(
+        `Conflicting asset dependency "${name}": package.json has ${merged[name]}, --asset has ${range}`,
+      )
+    }
+    merged[name] = range
+  }
+  return merged
+}
+
+function inferPackPolicy(files: Record<string, Uint8Array>): PackPolicy {
+  const hasRootPackageJson = Boolean(files['package.json'])
+  return {
+    readPackageJsonDependencies: hasRootPackageJson,
+    omitUnchangedInstalledFiles: hasRootPackageJson,
+  }
+}
+
+async function omitUnchangedInstalledFiles(
+  sourceZip: Uint8Array,
+  sourceFiles: Record<string, Uint8Array>,
+  assetDependencies: Record<string, string>,
+  cwd: string,
+): Promise<{ zip: Uint8Array; omitted: boolean }> {
+  const dependencyNames = new Set(Object.keys(assetDependencies))
+  if (dependencyNames.size === 0) return { zip: sourceZip, omitted: false }
+
+  const installRoot = await findInstallRoot(cwd)
+  const lock = await readMarketLock(installRoot)
+  const hashesByPath = new Map<string, string>()
+
+  for (const [name, asset] of Object.entries(lock.assets)) {
+    if (!dependencyNames.has(name)) continue
+    for (const [file, metadata] of Object.entries(asset.files)) {
+      hashesByPath.set(file, metadata.sha256)
+    }
+  }
+
+  if (hashesByPath.size === 0) return { zip: sourceZip, omitted: false }
+
+  let omitted = false
+  const filtered: Record<string, Uint8Array> = {}
+  for (const [file, content] of Object.entries(sourceFiles)) {
+    const normalizedPath = normalizedZipPath(file)
+    const lockedHash = normalizedPath ? hashesByPath.get(normalizedPath) : undefined
+    if (lockedHash && lockedHash === sha256(content)) {
+      omitted = true
+      continue
+    }
+    filtered[file] = content
+  }
+
+  return omitted ? { zip: zipSync(filtered), omitted } : { zip: sourceZip, omitted }
+}
+
+function normalizedZipPath(file: string): string | null {
+  const zipPath = file.replace(/\\/g, '/')
+  if (
+    zipPath.split('/').includes('..') ||
+    path.posix.isAbsolute(zipPath) ||
+    path.win32.isAbsolute(zipPath)
+  ) {
+    return null
+  }
+  return path.posix.normalize(zipPath)
+}
+
+async function resolveOneZipFile(cwd: string, zipFilter: string): Promise<string> {
+  const absolute = path.resolve(cwd, zipFilter)
+  const stat = await maybeStat(absolute)
+  if (stat?.isFile()) return assertZipFile(absolute)
+
+  const files = await listFiles(cwd)
+  const matches = files
+    .filter((file) => matchesFilter(path.relative(cwd, file), zipFilter))
+    .filter(isZipFile)
+    .sort()
+
+  if (matches.length === 0) {
+    throw new Error(`No .zip files matched "${zipFilter}"`)
+  }
+  if (matches.length > 1) {
+    throw new Error(`File filter matched ${matches.length} zips; pack one asset at a time`)
+  }
+
+  return matches[0]
+}
+
+function assertZipFile(file: string): string {
+  if (!isZipFile(file)) throw new Error(`Pack source must be a .zip: ${file}`)
+  return file
+}
+
+function isZipFile(file: string): boolean {
+  return /\.zip$/i.test(file)
+}
+
+async function maybeStat(file: string) {
+  try {
+    return await fs.stat(file)
+  } catch {
+    return null
+  }
+}
+
+async function listFiles(dir: string): Promise<string[]> {
+  const entries = await fs.readdir(dir, { withFileTypes: true })
+  const files: string[] = []
+  for (const entry of entries) {
+    if (entry.name === 'node_modules' || entry.name === '.git') continue
+    const fullPath = path.join(dir, entry.name)
+    if (entry.isDirectory()) {
+      files.push(...(await listFiles(fullPath)))
+    } else if (entry.isFile()) {
+      files.push(fullPath)
+    }
+  }
+  return files
+}
+
+function matchesFilter(file: string, filter: string): boolean {
+  const normalizedFile = file.split(path.sep).join('/')
+  const normalizedFilter = filter.split(path.sep).join('/')
+  const pattern =
+    '^' +
+    escapeRegExp(normalizedFilter)
+      .replace(/\\\*\\\*/g, '.*')
+      .replace(/\\\*/g, '[^/]*') +
+    '$'
+  return new RegExp(pattern).test(normalizedFile)
+}
+
+function escapeRegExp(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}

package/src/schemas.ts

@@ -48,6 +48,12 @@ export const skillDependenciesSchema = z.record(z.string(), z.string()).default(
 
 export const assetDescriptionSchema = z.string().max(MAX_ASSET_DESCRIPTION_LENGTH)
 
+// Asset visibility. `public` behaves as before (subject to the approval flow); `private` is
+// owner-only. Omitted on upload/generate — the server resolves the default from the caller's
+// entitlement (private when they hold `market:private`, else public).
+export const assetAccessSchema = z.enum(['public', 'private'])
+export type AssetAccess = z.infer<typeof assetAccessSchema>
+
 export const updateProfileSchema = z.object({
   name: z.string().min(1).max(100).optional(),
   image: z.string().url().optional(),
@@ -77,6 +83,9 @@ export const uploadZipSchema = z.object({
   assetDependencies: assetDependenciesSchema,
   skillDependencies: skillDependenciesSchema,
   tags: z.array(z.string()).default([]),
+  // Requested visibility. Omitted → server resolves from entitlement; `private` requires the
+  // `market:private` scope (rejected otherwise).
+  access: assetAccessSchema.optional(),
 })
 
 export const downloadZipSchema = z.object({
@@ -87,6 +96,8 @@ export const downloadZipSchema = z.object({
 export const generateAssetSchema = z.object({
   description: assetDescriptionSchema.min(3),
   type: assetTypeSchema.optional(),
+  // Requested visibility of the generated asset (same resolution as upload).
+  access: assetAccessSchema.optional(),
 })
 
 // The completed asset of a generation: an installable name@version.

package/src/skill.ts

@@ -14,6 +14,7 @@ market search "wooden chair" --type model --limit 3
 market install wooden-chair --cwd "$PWD"
 market list --cwd "$PWD"
 market preview wooden-chair --out /tmp/wooden-chair.png
+market pack scene.zip --out scene.packed.zip
 \`\`\`
 
 ## Workflow
@@ -24,8 +25,8 @@ market preview wooden-chair --out /tmp/wooden-chair.png
 4. \`install\` takes zero or more exact asset names (optionally \`name@range\`). With names, it installs those assets; with no names, it installs \`assetDependencies\` from the nearest \`package.json\`. It does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique. Use \`--force\` only when the user agrees to overwrite changed local files.
 5. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 6. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
-7. \`generate --type <type> "<prompt>"\` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are \`sound-effect\`, \`background-music\`, \`flipbook\`, and \`humanoid-model\`. Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation.
-8. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template uploads also read root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
+7. \`generate --type <type> "<prompt>"\` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are \`sound-effect\`, \`background-music\`, \`flipbook\`, \`humanoid-model\`, and \`environment\` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add \`--access public\` to publish the generated asset publicly, or \`--access private\` to keep it owner-only; when omitted the server defaults to private if you hold the \`market:private\` entitlement, else public (\`--access private\` requires that entitlement). \`generate\` waits for the asset and installs it — one command for quick types. For a long one (e.g. \`humanoid-model\`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run \`market generate install <jobId>\` to continue — it resumes the SAME job where the last call left off and installs when ready. Just re-run \`generate install <jobId>\` until it prints "Generated and installed" (it exits 0 while still generating, 1 on failure). No type is flagged "slow" — anything that outlasts one wait just continues on the next call.
+8. Use \`pack <zip>\` to create the same Market asset zip that \`upload\` sends. \`pack\` runs offline, infers template packing from a root \`package.json\`, and accepts \`--type\` only when you need to override that inference. \`upload\` runs the shared pack step internally, then publishes: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags on either command: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template pack/upload also reads root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
 9. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
 10. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class and Three.js \`KTX2Loader\` for Basis-compressed files; \`market preview\` fetches the middle frame from the flipbook.