@drawcall/market 0.1.49 → 0.1.51

package/dist/pack.js

@@ -0,0 +1,265 @@
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { unzipSync, zipSync } from 'fflate';
+import ignore from 'ignore';
+import { findInstallRoot } from './install.js';
+import { readMarketLock, sha256 } from './market-lock.js';
+import { packageJsonAssetDependenciesFromFiles, packageJsonNpmDependenciesFromFiles, } from './package-json.js';
+import { MAX_UPLOAD_ZIP_SIZE_BYTES } from './schemas.js';
+export async function packAsset(zipFilter, opts) {
+    const cwd = opts.cwd ?? process.cwd();
+    const zipFile = await resolveOneZipFile(cwd, zipFilter);
+    const zipStat = await fs.stat(zipFile);
+    if (zipStat.size >= MAX_UPLOAD_ZIP_SIZE_BYTES) {
+        throw new Error('Packed zip must be smaller than 1 GB');
+    }
+    const sourceZip = new Uint8Array(await fs.readFile(zipFile));
+    const sourceFiles = unzipSync(sourceZip);
+    const policy = opts.policy ?? inferPackPolicy(sourceFiles);
+    const packageJsonAssetDependencies = policy.readPackageJsonDependencies
+        ? packageJsonAssetDependenciesFromFiles(sourceFiles)
+        : {};
+    const assetDependencies = mergeAssetDependencies(packageJsonAssetDependencies, opts.dependencies.assetDependencies);
+    const packageJsonNpmDependencies = policy.readPackageJsonDependencies
+        ? packageJsonNpmDependenciesFromFiles(sourceFiles)
+        : {};
+    const npmDependencies = { ...packageJsonNpmDependencies, ...opts.dependencies.npmDependencies };
+    // Drop anything the zip's own .gitignore excludes (node_modules, build output, secrets…), then —
+    // for templates — omit unchanged installed dependency files. Only removals happen, so a smaller
+    // count means something was dropped; re-zip only then.
+    const withoutIgnored = applyGitignore(sourceFiles);
+    const files = policy.omitUnchangedInstalledFiles
+        ? await withoutUnchangedInstalledFiles(withoutIgnored, assetDependencies, cwd)
+        : withoutIgnored;
+    const sourceCount = Object.keys(sourceFiles).length;
+    const afterIgnoreCount = Object.keys(withoutIgnored).length;
+    const finalCount = Object.keys(files).length;
+    return {
+        sourcePath: zipFile,
+        zip: finalCount < sourceCount ? zipSync(files) : sourceZip,
+        npmDependencies,
+        assetDependencies,
+        skillDependencies: opts.dependencies.skillDependencies,
+        omittedUnchangedInstalledFiles: finalCount < afterIgnoreCount,
+        gitignoredFiles: sourceCount - afterIgnoreCount,
+    };
+}
+const GITIGNORE_FILENAME = '.gitignore';
+/**
+ * Drop every zip entry excluded by a `.gitignore` inside the zip. `.gitignore` files are applied
+ * per-directory (git semantics: a nested `.gitignore` only affects its own subtree), so a naively
+ * built asset zip never ships `node_modules`, build output, or secrets.
+ */
+function applyGitignore(files) {
+    const matchers = gitignoreMatchers(files);
+    if (matchers.length === 0)
+        return files;
+    const kept = {};
+    for (const [name, content] of Object.entries(files)) {
+        if (!isGitignored(name, matchers))
+            kept[name] = content;
+    }
+    return kept;
+}
+function gitignoreMatchers(files) {
+    const matchers = [];
+    for (const [name, content] of Object.entries(files)) {
+        if (path.posix.basename(name) !== GITIGNORE_FILENAME)
+            continue;
+        const dir = name.slice(0, name.length - GITIGNORE_FILENAME.length);
+        matchers.push({ dir, filter: ignore().add(new TextDecoder().decode(content)) });
+    }
+    return matchers;
+}
+function isGitignored(name, matchers) {
+    // fflate keeps directory entries with a trailing slash; the `ignore` lib matches directory patterns
+    // (`dist/`) against exactly that form, so the path is passed through unchanged.
+    return matchers.some((matcher) => {
+        if (!name.startsWith(matcher.dir))
+            return false;
+        const relative = name.slice(matcher.dir.length);
+        return relative.length > 0 && matcher.filter.ignores(relative);
+    });
+}
+export function parsePackDependencies(specs) {
+    return {
+        npmDependencies: parseVersionedDeps(specs.npm ?? [], 'npm'),
+        assetDependencies: parseVersionedDeps(specs.asset ?? [], 'asset'),
+        skillDependencies: parseSkillDeps(specs.skill ?? []),
+    };
+}
+export function packPolicyForType(type) {
+    if (!type)
+        return undefined;
+    return {
+        readPackageJsonDependencies: type === 'template',
+        omitUnchangedInstalledFiles: type === 'template',
+    };
+}
+export function packPolicyFromInstallMetadata(metadata) {
+    return {
+        readPackageJsonDependencies: metadata?.readAssetDependenciesFromPackageJson ?? false,
+        omitUnchangedInstalledFiles: metadata?.omitUnchangedInstalledFilesOnUpload ?? false,
+    };
+}
+/**
+ * Parse `name@range` specs (npm or asset deps) into a name→range record. The
+ * range is optional and defaults to `*`. A leading `@` is treated as a scope
+ * marker, so `@scope/pkg@^1.0.0` splits into `@scope/pkg` and `^1.0.0`.
+ */
+export function parseVersionedDeps(specs, kind) {
+    const out = {};
+    for (const spec of specs) {
+        const at = spec.lastIndexOf('@');
+        const hasRange = at > 0;
+        const name = hasRange ? spec.slice(0, at) : spec;
+        const range = hasRange ? spec.slice(at + 1) : '*';
+        if (!name || !range) {
+            throw new Error(`Invalid ${kind} dependency "${spec}". Use name@range (e.g. three@^0.178.0).`);
+        }
+        if (name in out) {
+            throw new Error(`Duplicate ${kind} dependency "${name}".`);
+        }
+        out[name] = range;
+    }
+    return out;
+}
+/**
+ * Parse `label=source` specs into a label→source record. The source is passed
+ * verbatim to `skills add` (a GitHub/git ref or a local path), so only the
+ * first `=` is treated as the separator.
+ */
+export function parseSkillDeps(specs) {
+    const out = {};
+    for (const spec of specs) {
+        const eq = spec.indexOf('=');
+        if (eq <= 0 || eq === spec.length - 1) {
+            throw new Error(`Invalid skill dependency "${spec}". Use label=source ` +
+                `(e.g. web-design=vercel-labs/agent-skills).`);
+        }
+        const label = spec.slice(0, eq);
+        if (label in out) {
+            throw new Error(`Duplicate skill dependency "${label}".`);
+        }
+        out[label] = spec.slice(eq + 1);
+    }
+    return out;
+}
+function mergeAssetDependencies(fromPackageJson, explicit) {
+    const merged = { ...fromPackageJson };
+    for (const [name, range] of Object.entries(explicit)) {
+        if (name in merged && merged[name] !== range) {
+            throw new Error(`Conflicting asset dependency "${name}": package.json has ${merged[name]}, --asset has ${range}`);
+        }
+        merged[name] = range;
+    }
+    return merged;
+}
+function inferPackPolicy(files) {
+    const hasRootPackageJson = Boolean(files['package.json']);
+    return {
+        readPackageJsonDependencies: hasRootPackageJson,
+        omitUnchangedInstalledFiles: hasRootPackageJson,
+    };
+}
+// Drop dependency files whose bytes still match what `.drawcall/market-lock.json` recorded as
+// installed, so a template ships only its own (edited or new) files. Returns the surviving entries.
+async function withoutUnchangedInstalledFiles(files, assetDependencies, cwd) {
+    const dependencyNames = new Set(Object.keys(assetDependencies));
+    if (dependencyNames.size === 0)
+        return files;
+    const installRoot = await findInstallRoot(cwd);
+    const lock = await readMarketLock(installRoot);
+    const hashesByPath = new Map();
+    for (const [name, asset] of Object.entries(lock.assets)) {
+        if (!dependencyNames.has(name))
+            continue;
+        for (const [file, metadata] of Object.entries(asset.files)) {
+            hashesByPath.set(file, metadata.sha256);
+        }
+    }
+    if (hashesByPath.size === 0)
+        return files;
+    const kept = {};
+    for (const [file, content] of Object.entries(files)) {
+        const normalizedPath = normalizedZipPath(file);
+        const lockedHash = normalizedPath ? hashesByPath.get(normalizedPath) : undefined;
+        if (lockedHash && lockedHash === sha256(content))
+            continue;
+        kept[file] = content;
+    }
+    return kept;
+}
+function normalizedZipPath(file) {
+    const zipPath = file.replace(/\\/g, '/');
+    if (zipPath.split('/').includes('..') ||
+        path.posix.isAbsolute(zipPath) ||
+        path.win32.isAbsolute(zipPath)) {
+        return null;
+    }
+    return path.posix.normalize(zipPath);
+}
+async function resolveOneZipFile(cwd, zipFilter) {
+    const absolute = path.resolve(cwd, zipFilter);
+    const stat = await maybeStat(absolute);
+    if (stat?.isFile())
+        return assertZipFile(absolute);
+    const files = await listFiles(cwd);
+    const matches = files
+        .filter((file) => matchesFilter(path.relative(cwd, file), zipFilter))
+        .filter(isZipFile)
+        .sort();
+    if (matches.length === 0) {
+        throw new Error(`No .zip files matched "${zipFilter}"`);
+    }
+    if (matches.length > 1) {
+        throw new Error(`File filter matched ${matches.length} zips; pack one asset at a time`);
+    }
+    return matches[0];
+}
+function assertZipFile(file) {
+    if (!isZipFile(file))
+        throw new Error(`Pack source must be a .zip: ${file}`);
+    return file;
+}
+function isZipFile(file) {
+    return /\.zip$/i.test(file);
+}
+async function maybeStat(file) {
+    try {
+        return await fs.stat(file);
+    }
+    catch {
+        return null;
+    }
+}
+async function listFiles(dir) {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        if (entry.name === 'node_modules' || entry.name === '.git')
+            continue;
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...(await listFiles(fullPath)));
+        }
+        else if (entry.isFile()) {
+            files.push(fullPath);
+        }
+    }
+    return files;
+}
+function matchesFilter(file, filter) {
+    const normalizedFile = file.split(path.sep).join('/');
+    const normalizedFilter = filter.split(path.sep).join('/');
+    const pattern = '^' +
+        escapeRegExp(normalizedFilter)
+            .replace(/\\\*\\\*/g, '.*')
+            .replace(/\\\*/g, '[^/]*') +
+        '$';
+    return new RegExp(pattern).test(normalizedFile);
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=pack.js.map

package/dist/pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../src/pack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAA;AAC3C,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GACpC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,yBAAyB,EAAkB,MAAM,cAAc,CAAA;AAoCxE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,IAAsB;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAA;IAC1D,MAAM,4BAA4B,GAAG,MAAM,CAAC,2BAA2B;QACrE,CAAC,CAAC,qCAAqC,CAAC,WAAW,CAAC;QACpD,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,iBAAiB,GAAG,sBAAsB,CAC9C,4BAA4B,EAC5B,IAAI,CAAC,YAAY,CAAC,iBAAiB,CACpC,CAAA;IAED,MAAM,0BAA0B,GAAG,MAAM,CAAC,2BAA2B;QACnE,CAAC,CAAC,mCAAmC,CAAC,WAAW,CAAC;QAClD,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,eAAe,GAAG,EAAE,GAAG,0BAA0B,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAA;IAE/F,iGAAiG;IACjG,gGAAgG;IAChG,uDAAuD;IACvD,MAAM,cAAc,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,2BAA2B;QAC9C,CAAC,CAAC,MAAM,8BAA8B,CAAC,cAAc,EAAE,iBAAiB,EAAE,GAAG,CAAC;QAC9E,CAAC,CAAC,cAAc,CAAA;IAElB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAA;IACnD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAA;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAA;IAE5C,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1D,eAAe;QACf,iBAAiB;QACjB,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,iBAAiB;QACtD,8BAA8B,EAAE,UAAU,GAAG,gBAAgB;QAC7D,eAAe,EAAE,WAAW,GAAG,gBAAgB;KAChD,CAAA;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAEvC;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAiC;IACvD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEvC,MAAM,IAAI,GAA+B,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAQD,SAAS,iBAAiB,CAAC,KAAiC;IAC1D,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,kBAAkB;YAAE,SAAQ;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAA4B;IAC9D,oGAAoG;IACpG,gFAAgF;IAChF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/C,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA0B;IAC9D,OAAO;QACL,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC;QAC3D,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC;QACjE,iBAAiB,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,OAAO;QACL,2BAA2B,EAAE,IAAI,KAAK,UAAU;QAChD,2BAA2B,EAAE,IAAI,KAAK,UAAU;KACjD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAA0C;IAE1C,OAAO;QACL,2BAA2B,EAAE,QAAQ,EAAE,oCAAoC,IAAI,KAAK;QACpF,2BAA2B,EAAE,QAAQ,EAAE,mCAAmC,IAAI,KAAK;KACpF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAe,EAAE,IAAqB;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAA;QACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,gBAAgB,IAAI,0CAA0C,CAAC,CAAA;QAChG,CAAC;QACD,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,gBAAgB,IAAI,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,sBAAsB;gBACrD,6CAA6C,CAChD,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC/B,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,IAAI,CAAC,CAAA;QAC3D,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,sBAAsB,CAC7B,eAAuC,EACvC,QAAgC;IAEhC,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,EAAE,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,uBAAuB,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CACjG,CAAA;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IACtB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAiC;IACxD,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;IACzD,OAAO;QACL,2BAA2B,EAAE,kBAAkB;QAC/C,2BAA2B,EAAE,kBAAkB;KAChD,CAAA;AACH,CAAC;AAED,8FAA8F;AAC9F,oGAAoG;AACpG,KAAK,UAAU,8BAA8B,CAC3C,KAAiC,EACjC,iBAAyC,EACzC,GAAW;IAEX,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAC/D,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE5C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;IAE9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QACxC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEzC,MAAM,IAAI,GAA+B,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChF,IAAI,UAAU,IAAI,UAAU,KAAK,MAAM,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;IACtB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACxC,IACE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAC9B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,SAAiB;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,IAAI,EAAE,MAAM,EAAE;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAElD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;SACpE,MAAM,CAAC,SAAS,CAAC;SACjB,IAAI,EAAE,CAAA;IAET,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,GAAG,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,MAAM,iCAAiC,CAAC,CAAA;IACzF,CAAC;IAED,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAA;IAC5E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzD,MAAM,OAAO,GACX,GAAG;QACH,YAAY,CAAC,gBAAgB,CAAC;aAC3B,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;aAC1B,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,GAAG,CAAA;IACL,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC"}

package/dist/skill.d.ts

@@ -1,2 +1,2 @@
-export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary lines.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --cwd \"$PWD\"\nmarket list --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\n```\n\n## Workflow\n\n1. In an existing repo, run `list --cwd \"$PWD\"` first to see installed local assets from `.drawcall/market-lock.json`. Use the listed names with `preview <name>` when you want preview images.\n2. Search first unless the user already gave an exact asset name. `search` requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, `environment`, or `flipbook`.\n3. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5 and prints full descriptions.\n4. `install` takes zero or more exact asset names (optionally `name@range`). With names, it installs those assets; with no names, it installs `assetDependencies` from the nearest `package.json`. It does not search or generate. Find names with `search` first. No `--type` is needed \u2014 asset names are unique. Use `--force` only when the user agrees to overwrite changed local files.\n5. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.\n6. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n7. `generate --type <type> \"<prompt>\"` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are `sound-effect`, `background-music`, `flipbook`, `humanoid-model`, and `environment` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add `--access public` to publish the generated asset publicly, or `--access private` to keep it owner-only; when omitted the server defaults to private if you hold the `market:private` entitlement, else public (`--access private` requires that entitlement).\n8. Upload only when publishing is requested: `market upload <name> <zip> \"<description>\" --type <type>`. Declare dependencies with repeatable flags: `--npm name@range`, `--asset name@range`, `--skill label=source`. Template uploads also read root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template upload omits installed dependency files whose hashes still match `.drawcall/market-lock.json`, so edited local files stay in the template. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip \"A scene\" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.\n9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n10. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.\n\n## Humanoid animations\n\n`humanoid-animation` assets are single-clip GLBs \u2014 one motion per asset (one idle, one walk-forward, one jump, one attack) on a normalized skeleton that retargets onto any humanoid, whatever its role. A behaving character is therefore a *set* of clips, not one asset: from what the character actually does, budget the clips it needs \u2014 an idle, its locomotion (walk/run, often split by direction: fwd/bwd/left/right), and one clip per distinct action and reaction it performs \u2014 then search for each separately.\n\n`humanoid-model` assets share that same normalized skeleton and are authored to a **consistent real-world scale** \u2014 they come in at roughly the same height as each other. So you do **not** need to rescale one humanoid to match another (player vs. enemy vs. NPC); dropped in as-is they already stand at a consistent size. Avoid the trap of measuring one character's height and scaling others to it \u2014 besides being unnecessary, measuring a rigged/animated character's bounding box is unreliable and produces giants (see the `math` skill on `Box3` and skinned meshes). If you ever do need a deliberate size difference (a boss, a child NPC), apply an explicit chosen multiplier, not a measured one.\n\nSearch one motion per query, named by the motion, because results rank by keyword overlap: a query naming several motions at once is dominated by whichever word matches the most assets and buries the others, so real clips look like a gap when they exist. Names describe the motion, not the character \u2014 so search the motion (`\"walk forward\"`, `\"reload\"`, `\"jump\"`), not the role (`\"player run\"`, `\"boss attack\"`). If a motion finds nothing, retry with synonyms (run/jog/sprint, attack/swing/strike).\n\n## Output\n\nCommands print concise, line-oriented summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled:\n- wooden-chair@1.0.0 (asset)\n  description: Low-poly wooden chair\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\n- three@^0.178.0 (npm)\n- web-design \u2190 https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)\nInstalled assets: 1\n- wooden-chair@1.0.0 (model)\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nAssets may also declare `skill` dependencies, installed for you via the `skills` CLI (`skills add`) during `install`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires `npx` to be available.\n\nInstalled non-template assets are saved to `package.json.assetDependencies`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in `.drawcall/market-lock.json`.\n\n`list` is offline: it reads `.drawcall/market-lock.json` from the nearest package root and prints exact installed names, versions, types, and installed file paths.\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
+export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary lines.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --cwd \"$PWD\"\nmarket list --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\nmarket pack scene.zip --out scene.packed.zip\n```\n\n## Workflow\n\n1. In an existing repo, run `list --cwd \"$PWD\"` first to see installed local assets from `.drawcall/market-lock.json`. Use the listed names with `preview <name>` when you want preview images.\n2. Search first unless the user already gave an exact asset name. `search` requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, `environment`, or `flipbook`.\n3. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5 and prints full descriptions.\n4. `install` takes zero or more exact asset names (optionally `name@range`). With names, it installs those assets; with no names, it installs `assetDependencies` from the nearest `package.json`. It does not search or generate. Find names with `search` first. No `--type` is needed \u2014 asset names are unique. Use `--force` only when the user agrees to overwrite changed local files.\n5. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.\n6. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n7. `generate --type <type> \"<prompt>\"` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are `sound-effect`, `background-music`, `flipbook`, `humanoid-model`, and `environment` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add `--access public` to publish the generated asset publicly, or `--access private` to keep it owner-only; when omitted the server defaults to private if you hold the `market:private` entitlement, else public (`--access private` requires that entitlement). `generate` waits for the asset and installs it \u2014 one command for quick types. For a long one (e.g. `humanoid-model`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run `market generate install <jobId>` to continue \u2014 it resumes the SAME job where the last call left off and installs when ready. Just re-run `generate install <jobId>` until it prints \"Generated and installed\" (it exits 0 while still generating, 1 on failure). No type is flagged \"slow\" \u2014 anything that outlasts one wait just continues on the next call.\n8. Use `pack <zip>` to create the same Market asset zip that `upload` sends. `pack` runs offline, infers template packing from a root `package.json`, and accepts `--type` only when you need to override that inference. `upload` runs the shared pack step internally, then publishes: `market upload <name> <zip> \"<description>\" --type <type>`. Declare dependencies with repeatable flags on either command: `--npm name@range`, `--asset name@range`, `--skill label=source`. Template pack/upload also reads root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match `.drawcall/market-lock.json`, so edited local files stay in the template. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip \"A scene\" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.\n9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n10. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.\n\n## Humanoid animations\n\n`humanoid-animation` assets are single-clip GLBs \u2014 one motion per asset (one idle, one walk-forward, one jump, one attack) on a normalized skeleton that retargets onto any humanoid, whatever its role. A behaving character is therefore a *set* of clips, not one asset: from what the character actually does, budget the clips it needs \u2014 an idle, its locomotion (walk/run, often split by direction: fwd/bwd/left/right), and one clip per distinct action and reaction it performs \u2014 then search for each separately.\n\n`humanoid-model` assets share that same normalized skeleton and are authored to a **consistent real-world scale** \u2014 they come in at roughly the same height as each other. So you do **not** need to rescale one humanoid to match another (player vs. enemy vs. NPC); dropped in as-is they already stand at a consistent size. Avoid the trap of measuring one character's height and scaling others to it \u2014 besides being unnecessary, measuring a rigged/animated character's bounding box is unreliable and produces giants (see the `math` skill on `Box3` and skinned meshes). If you ever do need a deliberate size difference (a boss, a child NPC), apply an explicit chosen multiplier, not a measured one.\n\nSearch one motion per query, named by the motion, because results rank by keyword overlap: a query naming several motions at once is dominated by whichever word matches the most assets and buries the others, so real clips look like a gap when they exist. Names describe the motion, not the character \u2014 so search the motion (`\"walk forward\"`, `\"reload\"`, `\"jump\"`), not the role (`\"player run\"`, `\"boss attack\"`). If a motion finds nothing, retry with synonyms (run/jog/sprint, attack/swing/strike).\n\n## Output\n\nCommands print concise, line-oriented summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled:\n- wooden-chair@1.0.0 (asset)\n  description: Low-poly wooden chair\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\n- three@^0.178.0 (npm)\n- web-design \u2190 https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)\nInstalled assets: 1\n- wooden-chair@1.0.0 (model)\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nAssets may also declare `skill` dependencies, installed for you via the `skills` CLI (`skills add`) during `install`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires `npx` to be available.\n\nInstalled non-template assets are saved to `package.json.assetDependencies`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in `.drawcall/market-lock.json`.\n\n`list` is offline: it reads `.drawcall/market-lock.json` from the nearest package root and prints exact installed names, versions, types, and installed file paths.\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
 //# sourceMappingURL=skill.d.ts.map

package/dist/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,qqOAqEvB,CAAA"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,yhQAsEvB,CAAA"}

package/dist/skill.js

@@ -14,6 +14,7 @@ market search "wooden chair" --type model --limit 3
 market install wooden-chair --cwd "$PWD"
 market list --cwd "$PWD"
 market preview wooden-chair --out /tmp/wooden-chair.png
+market pack scene.zip --out scene.packed.zip
 \`\`\`
 
 ## Workflow
@@ -24,8 +25,8 @@ market preview wooden-chair --out /tmp/wooden-chair.png
 4. \`install\` takes zero or more exact asset names (optionally \`name@range\`). With names, it installs those assets; with no names, it installs \`assetDependencies\` from the nearest \`package.json\`. It does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique. Use \`--force\` only when the user agrees to overwrite changed local files.
 5. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 6. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
-7. \`generate --type <type> "<prompt>"\` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are \`sound-effect\`, \`background-music\`, \`flipbook\`, \`humanoid-model\`, and \`environment\` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add \`--access public\` to publish the generated asset publicly, or \`--access private\` to keep it owner-only; when omitted the server defaults to private if you hold the \`market:private\` entitlement, else public (\`--access private\` requires that entitlement).
-8. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template uploads also read root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
+7. \`generate --type <type> "<prompt>"\` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are \`sound-effect\`, \`background-music\`, \`flipbook\`, \`humanoid-model\`, and \`environment\` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add \`--access public\` to publish the generated asset publicly, or \`--access private\` to keep it owner-only; when omitted the server defaults to private if you hold the \`market:private\` entitlement, else public (\`--access private\` requires that entitlement). \`generate\` waits for the asset and installs it — one command for quick types. For a long one (e.g. \`humanoid-model\`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run \`market generate install <jobId>\` to continue — it resumes the SAME job where the last call left off and installs when ready. Just re-run \`generate install <jobId>\` until it prints "Generated and installed" (it exits 0 while still generating, 1 on failure). No type is flagged "slow" — anything that outlasts one wait just continues on the next call.
+8. Use \`pack <zip>\` to create the same Market asset zip that \`upload\` sends. \`pack\` runs offline, infers template packing from a root \`package.json\`, and accepts \`--type\` only when you need to override that inference. \`upload\` runs the shared pack step internally, then publishes: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags on either command: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template pack/upload also reads root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
 9. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
 10. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class and Three.js \`KTX2Loader\` for Basis-compressed files; \`market preview\` fetches the middle frame from the flipbook.
 

package/dist/skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqE1B,CAAA"}
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsE1B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawcall/market",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "repository": {
     "type": "git",
     "url": "https://github.com/drawcall-ai/market",
@@ -36,7 +36,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsx src/cli.ts",
-    "test:install-layout": "tsx --test tests/install-layout.test.ts tests/install-command.test.ts tests/list-command.test.ts",
+    "test:install-layout": "tsx --test tests/install-layout.test.ts tests/install-command.test.ts tests/list-command.test.ts tests/pack.test.ts",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
@@ -45,6 +45,7 @@
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "fflate": "^0.8.2",
+    "ignore": "^7.0.5",
     "nypm": "^0.6.0",
     "open": "^10.1.0",
     "openid-client": "^6.8.4",

package/skills/market/SKILL.md

@@ -14,6 +14,7 @@ npx @drawcall/market search "wooden chair" --type model --limit 3
 npx @drawcall/market install wooden-chair --cwd "$PWD"
 npx @drawcall/market list --cwd "$PWD"
 npx @drawcall/market preview wooden-chair --out /tmp/wooden-chair.png
+npx @drawcall/market pack scene.zip --out scene.packed.zip
 ```
 
 ## Workflow
@@ -24,8 +25,8 @@ npx @drawcall/market preview wooden-chair --out /tmp/wooden-chair.png
 4. `install` takes zero or more exact asset names (optionally `name@range`). With names, it installs those assets; with no names, it installs `assetDependencies` from the nearest `package.json`. It does not search or generate. Find names with `search` first. No `--type` is needed — asset names are unique. Use `--force` only when the user agrees to overwrite changed local files.
 5. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.
 6. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
-7. `generate --type <type> "<prompt>"` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are `sound-effect`, `background-music`, `flipbook`, `humanoid-model`, and `environment` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add `--access public` to publish the generated asset publicly, or `--access private` to keep it owner-only; when omitted the server defaults to private if you hold the `market:private` entitlement, else public (`--access private` requires that entitlement).
-8. Upload only when publishing is requested: `market upload <name> <zip> "<description>" --type <type>`. Declare dependencies with repeatable flags: `--npm name@range`, `--asset name@range`, `--skill label=source`. Use `--access public|private` to set visibility (same default rule as generate): a private asset is visible and installable only by you. Template uploads also read root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template upload omits installed dependency files whose hashes still match `.drawcall/market-lock.json`, so edited local files stay in the template. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.
+7. `generate --type <type> "<prompt>"` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are `sound-effect`, `background-music`, `flipbook`, `humanoid-model`, and `environment` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add `--access public` to publish the generated asset publicly, or `--access private` to keep it owner-only; when omitted the server defaults to private if you hold the `market:private` entitlement, else public (`--access private` requires that entitlement). `generate` waits for the asset and installs it — one command for quick types. For a long one (e.g. `humanoid-model`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run `market generate install <jobId>` to continue — it resumes the SAME job where the last call left off and installs when ready. Just re-run `generate install <jobId>` until it prints "Generated and installed" (it exits 0 while still generating, 1 on failure). No type is flagged "slow" — anything that outlasts one wait just continues on the next call.
+8. Use `pack <zip>` to create the same Market asset zip that `upload` sends. `pack` runs offline, infers template packing from a root `package.json`, and accepts `--type` only when you need to override that inference. `upload` runs the shared pack step internally, then publishes: `market upload <name> <zip> "<description>" --type <type>`. Declare dependencies with repeatable flags on either command: `--npm name@range`, `--asset name@range`, `--skill label=source`. Use `--access public|private` on upload to set visibility (same default rule as generate): a private asset is visible and installable only by you. Template pack/upload also reads root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match `.drawcall/market-lock.json`, so edited local files stay in the template. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.
 9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.
 10. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.
 

package/src/cli.ts

@@ -10,7 +10,9 @@ import { installCommand } from './commands/install.js'
 import { searchCommand } from './commands/search.js'
 import { agentCommand } from './commands/agent.js'
 import { generateCommand } from './commands/generate.js'
+import { generateInstallCommand } from './commands/generate-install.js'
 import { listCommand } from './commands/list.js'
+import { packCommand } from './commands/pack.js'
 import { previewCommand } from './commands/preview.js'
 import { uploadCommand } from './commands/upload.js'
 import { logout } from './commands/logout.js'
@@ -113,6 +115,39 @@ program
     })
   })
 
+program
+  .command('pack')
+  .description('Create a Market asset zip using the same packaging step as upload')
+  .argument('<zip-filter>', '.zip path or glob')
+  .addOption(typeOption)
+  .option('--out <file>', 'Output zip path')
+  .option('--cwd <dir>', 'Project directory')
+  .option('--npm <dep>', 'npm dependency name@range (repeatable)', collect, [])
+  .option('--asset <dep>', 'asset dependency name@range (repeatable)', collect, [])
+  .option('--skill <dep>', 'skill dependency label=source (repeatable)', collect, [])
+  .action(
+    async (
+      zipFilter: string,
+      opts: {
+        type?: AssetType
+        out?: string
+        cwd?: string
+        npm: string[]
+        asset: string[]
+        skill: string[]
+      },
+    ) => {
+      await packCommand(zipFilter, {
+        type: opts.type,
+        out: opts.out,
+        cwd: opts.cwd,
+        npm: opts.npm,
+        asset: opts.asset,
+        skill: opts.skill,
+      })
+    },
+  )
+
 program
   .command('search')
   .description('Find assets')
@@ -211,19 +246,23 @@ program
     })
   })
 
-program
+const generate = program
   .command('generate')
-  .description('Generate and install')
-  .argument('<description>', 'Asset prompt')
+  .description('Generate and install an asset, or check a generation job')
+  .argument('[description]', 'Asset prompt (omit when using a subcommand)')
   .addOption(typeOption)
   .addOption(apiOption)
   .option('--cwd <dir>', 'Project directory')
   .addOption(accessOption)
   .action(
     async (
-      description: string,
+      description: string | undefined,
       opts: { type?: AssetType; api?: string; cwd?: string; access?: AssetAccess },
     ) => {
+      if (!description) {
+        generate.help({ error: true })
+        return
+      }
       requireType(opts.type, 'Generate')
       await generateCommand(description, {
         type: opts.type,
@@ -234,6 +273,24 @@ program
     },
   )
 
+// `generate install <jobId>` finishes a slow (job-based) generation: it checks the job once and, when
+// it has completed, installs the produced asset into the project. Still running → prints a note and
+// exits 0 (run again later); failed → exits 1. Fast asset types never need this — `generate` installs
+// them inline. ("install" over "status": the command's job is to integrate the asset, not just report.)
+generate
+  .command('install')
+  .description('Install the asset from a generation job once it has completed')
+  .argument('<jobId>', 'Job id printed by `market generate`')
+  .addOption(apiOption)
+  .option('--cwd <dir>', 'Project directory')
+  // Read merged options: `--cwd`/`--api` after `generate install` are otherwise captured by the
+  // parent `generate` command (which declares the same options), leaving this subcommand's own opts
+  // undefined. `optsWithGlobals()` surfaces whichever level parsed them.
+  .action(async (jobId: string, _options, command: Command) => {
+    const { api, cwd } = command.optsWithGlobals()
+    await generateInstallCommand(jobId, { baseUrl: api, cwd })
+  })
+
 if (process.argv.length <= 2) {
   program.outputHelp()
   process.exit(0)

package/src/commands/agent.ts

@@ -4,7 +4,7 @@ import ora from 'ora'
 import { getCliClient } from '../cli-client.js'
 import { agentAndWait } from '../agent.js'
 import { assetVersionRef } from '../output.js'
-import type { AgentResult } from '../index.js'
+import type { AgentResult } from '../schemas.js'
 
 export interface AgentCommandOptions {
   images?: string[]

package/src/commands/generate-install.ts

@@ -0,0 +1,36 @@
+import { getCliClient } from '../cli-client.js'
+import { waitForGeneration } from '../generate.js'
+import { generationRunningResult } from '../output.js'
+import { finishGeneration, startSpinner } from './generate.js'
+
+export interface GenerateInstallCommandOptions {
+  cwd?: string
+  baseUrl?: string
+}
+
+// Install the asset from a generation job. Block-and-polls for a bounded window (the command waits,
+// not the agent): installs on completion, fails loudly on error, or prints a note so the caller runs
+// it again to continue the same job.
+export async function generateInstallCommand(
+  jobId: string,
+  opts: GenerateInstallCommandOptions,
+): Promise<void> {
+  const { client, baseUrl } = await getCliClient({ baseUrl: opts.baseUrl, requireAuth: true })
+  const spinner = startSpinner('Generating asset')
+  try {
+    const outcome = await waitForGeneration(client, jobId, {
+      onProgress: (message) => {
+        spinner.text = message
+      },
+    })
+    await finishGeneration(client, outcome, {
+      cwd: opts.cwd,
+      baseUrl,
+      spinner,
+      stillRunning: generationRunningResult(jobId),
+    })
+  } catch (err) {
+    spinner.stop()
+    throw err
+  }
+}