@drawcall/market 0.1.53 → 0.1.55

package/dist/schemas.d.ts

@@ -94,6 +94,16 @@ export declare const downloadZipSchema: z.ZodObject<{
     name: z.ZodString;
     version: z.ZodString;
 }, z.core.$strip>;
+export declare const fileManifestSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The content hash of every file in an asset version, keyed by its install path — sha256 hex, the
+ * same digest the CLI computes locally. Lets a caller check whether a local file is identical to the
+ * canonical asset without keeping hashes itself (see `pack` omit-unchanged).
+ */
+export type AssetFileManifest = Record<string, string>;
 export declare const generateAssetSchema: z.ZodObject<{
     description: z.ZodString;
     type: z.ZodOptional<z.ZodEnum<{

package/dist/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,WAAW,kJAUd,CAAA;AACV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,eAAO,MAAM,eAAe;;;;;;;;;;EAAsB,CAAA;AAElD,eAAO,MAAM,yBAAyB,QAAqB,CAAA;AAC3D,eAAO,MAAM,4BAA4B,OAAO,CAAA;AAEhD,eAAO,MAAM,YAAY,aAKtB,CAAA;AAEH,eAAO,MAAM,eAAe,aAUxB,CAAA;AAEJ,eAAO,MAAM,qBAAqB,qDAA+C,CAAA;AAEjF,eAAO,MAAM,uBAAuB,qDAA+C,CAAA;AAKnF,eAAO,MAAM,uBAAuB,qDAA+C,CAAA;AAEnF,eAAO,MAAM,sBAAsB,aAA+C,CAAA;AAKlF,eAAO,MAAM,iBAAiB;;;EAAgC,CAAA;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;iBAO3B,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAI3B,CAAA;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;iBAY1B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;;iBAG5B,CAAA;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAA;AAKF,eAAO,MAAM,sBAAsB;;;;;;;6BAGjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,yBAAyB;;iBAEpC,CAAA;AAIF,eAAO,MAAM,uBAAuB;;;;;;;;;6BAIlC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAKvE,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;iBAE5B,CAAA;AAIF,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAKrE,eAAO,MAAM,iBAAiB;;;;;;;iBAG5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAK3D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;6BAI/B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,WAAW,kJAUd,CAAA;AACV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,eAAO,MAAM,eAAe;;;;;;;;;;EAAsB,CAAA;AAElD,eAAO,MAAM,yBAAyB,QAAqB,CAAA;AAC3D,eAAO,MAAM,4BAA4B,OAAO,CAAA;AAEhD,eAAO,MAAM,YAAY,aAKtB,CAAA;AAEH,eAAO,MAAM,eAAe,aAUxB,CAAA;AAEJ,eAAO,MAAM,qBAAqB,qDAA+C,CAAA;AAEjF,eAAO,MAAM,uBAAuB,qDAA+C,CAAA;AAKnF,eAAO,MAAM,uBAAuB,qDAA+C,CAAA;AAEnF,eAAO,MAAM,sBAAsB,aAA+C,CAAA;AAKlF,eAAO,MAAM,iBAAiB;;;EAAgC,CAAA;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;iBAO3B,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAI3B,CAAA;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;iBAY1B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;;iBAG5B,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEtD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAA;AAKF,eAAO,MAAM,sBAAsB;;;;;;;6BAGjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,yBAAyB;;iBAEpC,CAAA;AAIF,eAAO,MAAM,uBAAuB;;;;;;;;;6BAIlC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAKvE,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;iBAE5B,CAAA;AAIF,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAKrE,eAAO,MAAM,iBAAiB;;;;;;;iBAG5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAK3D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;6BAI/B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/schemas.js

@@ -69,6 +69,10 @@ export const downloadZipSchema = z.object({
     name: assetNameSchema,
     version: semverSchema,
 });
+export const fileManifestSchema = z.object({
+    name: assetNameSchema,
+    version: semverSchema,
+});
 export const generateAssetSchema = z.object({
     description: assetDescriptionSchema.min(3),
     type: assetTypeSchema.optional(),

package/dist/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,OAAO;IACP,gBAAgB;IAChB,SAAS;IACT,oBAAoB;IACpB,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,aAAa;IACb,UAAU;CACF,CAAA;AAGV,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CACJ,oDAAoD,EACpD,6CAA6C,CAC9C,CAAA;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,8BAA8B,EAC9B,0EAA0E,CAC3E;KACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;IAC5C,OAAO,EAAE,0EAA0E;CACpF,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAEjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAEnF,yEAAyE;AACzE,8EAA8E;AAC9E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAEnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;AAElF,4FAA4F;AAC5F,6FAA6F;AAC7F,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;AAG9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;CACxE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,YAAY;IACrB,WAAW,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,qBAAqB;IACtC,iBAAiB,EAAE,uBAAuB;IAC1C,iBAAiB,EAAE,uBAAuB;IAC1C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,2FAA2F;IAC3F,+CAA+C;IAC/C,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,YAAY;CACtB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,2EAA2E;IAC3E,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,YAAY;CACtB,CAAC,CAAA;AAEF,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACnE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACrE,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAEF,qGAAqG;AACrG,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACpE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1C,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC7D,CAAC,CAAA;AAGF,8EAA8E;AAC9E,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAEF,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAA;AAGF,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACxC,CAAC,CAAA;AAGF,gFAAgF;AAChF,0EAA0E;AAC1E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC7D,CAAC,CAAA"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,OAAO;IACP,gBAAgB;IAChB,SAAS;IACT,oBAAoB;IACpB,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,aAAa;IACb,UAAU;CACF,CAAA;AAGV,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CACJ,oDAAoD,EACpD,6CAA6C,CAC9C,CAAA;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,8BAA8B,EAC9B,0EAA0E,CAC3E;KACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;IAC5C,OAAO,EAAE,0EAA0E;CACpF,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAEjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAEnF,yEAAyE;AACzE,8EAA8E;AAC9E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAEnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;AAElF,4FAA4F;AAC5F,6FAA6F;AAC7F,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;AAG9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;CACxE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,YAAY;IACrB,WAAW,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,qBAAqB;IACtC,iBAAiB,EAAE,uBAAuB;IAC1C,iBAAiB,EAAE,uBAAuB;IAC1C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,2FAA2F;IAC3F,+CAA+C;IAC/C,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,YAAY;CACtB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,YAAY;CACtB,CAAC,CAAA;AASF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,2EAA2E;IAC3E,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,YAAY;CACtB,CAAC,CAAA;AAEF,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACnE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACrE,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAEF,qGAAqG;AACrG,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACpE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1C,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC7D,CAAC,CAAA;AAGF,8EAA8E;AAC9E,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAEF,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAA;AAGF,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACxC,CAAC,CAAA;AAGF,gFAAgF;AAChF,0EAA0E;AAC1E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC7D,CAAC,CAAA"}

package/dist/skill.d.ts

@@ -1,2 +1,2 @@
-export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary lines.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --cwd \"$PWD\"\nmarket list --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\nmarket pack scene.zip --out scene.packed.zip\n```\n\n## Workflow\n\n1. In an existing repo, run `list --cwd \"$PWD\"` first to see installed local assets from `.drawcall/market-lock.json`. Use the listed names with `preview <name>` when you want preview images.\n2. Search first unless the user already gave an exact asset name. `search` requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, `environment`, or `flipbook`.\n3. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5 and prints full descriptions.\n4. `install` takes zero or more exact asset names (optionally `name@range`). With names, it installs those assets; with no names, it installs `assetDependencies` from the nearest `package.json`. It does not search or generate. Find names with `search` first. No `--type` is needed \u2014 asset names are unique. Use `--force` only when the user agrees to overwrite changed local files.\n5. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.\n6. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n7. `generate --type <type> \"<prompt>\"` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are `sound-effect`, `background-music`, `flipbook`, `humanoid-model`, and `environment` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add `--access public` to publish the generated asset publicly, or `--access private` to keep it owner-only; when omitted the server defaults to private if you hold the `market:private` entitlement, else public (`--access private` requires that entitlement). `generate` waits for the asset and installs it \u2014 one command for quick types. For a long one (e.g. `humanoid-model`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run `market generate install <jobId>` to continue \u2014 it resumes the SAME job where the last call left off and installs when ready. Just re-run `generate install <jobId>` until it prints \"Generated and installed\" (it exits 0 while still generating, 1 on failure). No type is flagged \"slow\" \u2014 anything that outlasts one wait just continues on the next call.\n8. Use `pack <zip>` to create the same Market asset zip that `upload` sends. `pack` runs offline, infers template packing from a root `package.json`, and accepts `--type` only when you need to override that inference. `upload` runs the shared pack step internally, then publishes: `market upload <name> <zip> \"<description>\" --type <type>`. Declare dependencies with repeatable flags on either command: `--npm name@range`, `--asset name@range`, `--skill label=source`. Template pack/upload also reads root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match `.drawcall/market-lock.json`, so edited local files stay in the template. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip \"A scene\" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.\n9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n10. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.\n\n## Humanoid animations\n\n`humanoid-animation` assets are single-clip GLBs \u2014 one motion per asset (one idle, one walk-forward, one jump, one attack) on a normalized skeleton that retargets onto any humanoid, whatever its role. A behaving character is therefore a *set* of clips, not one asset: from what the character actually does, budget the clips it needs \u2014 an idle, its locomotion (walk/run, often split by direction: fwd/bwd/left/right), and one clip per distinct action and reaction it performs \u2014 then search for each separately.\n\n`humanoid-model` assets share that same normalized skeleton and are authored to a **consistent real-world scale** \u2014 they come in at roughly the same height as each other. So you do **not** need to rescale one humanoid to match another (player vs. enemy vs. NPC); dropped in as-is they already stand at a consistent size. Avoid the trap of measuring one character's height and scaling others to it \u2014 besides being unnecessary, measuring a rigged/animated character's bounding box is unreliable and produces giants (see the `math` skill on `Box3` and skinned meshes). If you ever do need a deliberate size difference (a boss, a child NPC), apply an explicit chosen multiplier, not a measured one.\n\nSearch one motion per query, named by the motion, because results rank by keyword overlap: a query naming several motions at once is dominated by whichever word matches the most assets and buries the others, so real clips look like a gap when they exist. Names describe the motion, not the character \u2014 so search the motion (`\"walk forward\"`, `\"reload\"`, `\"jump\"`), not the role (`\"player run\"`, `\"boss attack\"`). If a motion finds nothing, retry with synonyms (run/jog/sprint, attack/swing/strike).\n\n## Output\n\nCommands print concise, line-oriented summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled:\n- wooden-chair@1.0.0 (asset)\n  description: Low-poly wooden chair\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\n- three@^0.178.0 (npm)\n- web-design \u2190 https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)\nInstalled assets: 1\n- wooden-chair@1.0.0 (model)\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nAssets may also declare `skill` dependencies, installed for you via the `skills` CLI (`skills add`) during `install`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires `npx` to be available.\n\nInstalled non-template assets are saved to `package.json.assetDependencies`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in `.drawcall/market-lock.json`.\n\n`list` is offline: it reads `.drawcall/market-lock.json` from the nearest package root and prints exact installed names, versions, types, and installed file paths.\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
+export declare const marketSkill = "---\nname: market\ndescription: Find, preview, install, generate, and publish Drawcall Market assets from a coding agent.\n---\n\n# Drawcall Market\n\nUse the `market` CLI. Keep commands short and read the summary lines.\n\n## Quick Start\n\n```sh\nmarket search \"wooden chair\" --type model --limit 3\nmarket install wooden-chair --cwd \"$PWD\"\nmarket list --cwd \"$PWD\"\nmarket preview wooden-chair --out /tmp/wooden-chair.png\nmarket pack scene.zip --out scene.packed.zip\n```\n\n## Workflow\n\n1. In an existing repo, run `list --cwd \"$PWD\"` first to see installed local assets from `.drawcall/market-lock.json`. Use the listed names with `preview <name>` when you want preview images.\n2. Search first unless the user already gave an exact asset name. `search` requires `--type`; use `model` unless the user names another supported type: `humanoid-model`, `texture`, `humanoid-animation`, `template`, `sound-effect`, `background-music`, `environment`, or `flipbook`.\n3. Use `--limit 1` for lookup, `--limit 3` for choice. Search caps at 5 and prints full descriptions.\n4. `install` takes zero or more exact asset names (optionally `name@range`). With names, it installs those assets; with no names, it installs `assetDependencies` from the nearest `package.json`. It does not search or generate. Find names with `search` first. No `--type` is needed \u2014 asset names are unique. Use `--force` only when the user agrees to overwrite changed local files.\n5. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.\n6. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.\n7. `generate --type <type> \"<prompt>\"` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are `sound-effect`, `background-music`, `flipbook`, `humanoid-model`, and `environment` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add `--access public` to publish the generated asset publicly, or `--access private` to keep it owner-only; when omitted the server defaults to private if you hold the `market:private` entitlement, else public (`--access private` requires that entitlement). `generate` waits for the asset and installs it \u2014 one command for quick types. For a long one (e.g. `humanoid-model`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run `market generate install <jobId>` to continue \u2014 it resumes the SAME job where the last call left off and installs when ready. Just re-run `generate install <jobId>` until it prints \"Generated and installed\" (it exits 0 while still generating, 1 on failure). No type is flagged \"slow\" \u2014 anything that outlasts one wait just continues on the next call.\n8. Use `pack <zip>` to create the same Market asset zip that `upload` sends. `pack` runs offline, infers template packing from a root `package.json`, and accepts `--type` only when you need to override that inference. `upload` runs the shared pack step internally, then publishes: `market upload <name> <zip> \"<description>\" --type <type>`. Declare dependencies with repeatable flags on either command: `--npm name@range`, `--asset name@range`, `--skill label=source`. Template pack/upload also reads root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template pack/upload omits installed dependency files that still match the installed dependency's canonical content (its file hashes are fetched from the server, not stored locally), so edited local files stay in the template; this omit step needs the API, but simple non-template packs stay offline. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip \"A scene\" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.\n9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.\n10. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.\n\n## Humanoid animations\n\n`humanoid-animation` assets are single-clip GLBs \u2014 one motion per asset (one idle, one walk-forward, one jump, one attack) on a normalized skeleton that retargets onto any humanoid, whatever its role. A behaving character is therefore a *set* of clips, not one asset: from what the character actually does, budget the clips it needs \u2014 an idle, its locomotion (walk/run, often split by direction: fwd/bwd/left/right), and one clip per distinct action and reaction it performs \u2014 then search for each separately.\n\n`humanoid-model` assets share that same normalized skeleton and are authored to a **consistent real-world scale** \u2014 they come in at roughly the same height as each other. So you do **not** need to rescale one humanoid to match another (player vs. enemy vs. NPC); dropped in as-is they already stand at a consistent size. Avoid the trap of measuring one character's height and scaling others to it \u2014 besides being unnecessary, measuring a rigged/animated character's bounding box is unreliable and produces giants (see the `math` skill on `Box3` and skinned meshes). If you ever do need a deliberate size difference (a boss, a child NPC), apply an explicit chosen multiplier, not a measured one.\n\nSearch one motion per query, named by the motion, because results rank by keyword overlap: a query naming several motions at once is dominated by whichever word matches the most assets and buries the others, so real clips look like a gap when they exist. Names describe the motion, not the character \u2014 so search the motion (`\"walk forward\"`, `\"reload\"`, `\"jump\"`), not the role (`\"player run\"`, `\"boss attack\"`). If a motion finds nothing, retry with synonyms (run/jog/sprint, attack/swing/strike).\n\n## Output\n\nCommands print concise, line-oriented summaries:\n\n```text\nResults: 2/8 query=\"wooden chair\" type=model approval=approved\n- wooden-chair@1.0.0 | model | approved | Low-poly wooden chair\nInstalled:\n- wooden-chair@1.0.0 (asset)\n  description: Low-poly wooden chair\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\n- three@^0.178.0 (npm)\n- web-design \u2190 https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)\nInstalled assets: 1\n- wooden-chair@1.0.0 (model)\n  files:\n    public/model\n    \u2514\u2500 wooden-chair.glb\nSaved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png\n```\n\nAssets may also declare `skill` dependencies, installed for you via the `skills` CLI (`skills add`) during `install`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires `npx` to be available.\n\nInstalled non-template assets are saved to `package.json.assetDependencies`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file paths are recorded in `.drawcall/market-lock.json`; file content hashes now come from the server (`asset.fileManifest`), not the lock.\n\n`list` is offline: it reads `.drawcall/market-lock.json` from the nearest package root and prints exact installed names, versions, types, and installed file paths.\n\nIf search returns no results, try one broader noun phrase. If a command returns `Error: Not logged in...`, ask before running `market login`.\n";
 //# sourceMappingURL=skill.d.ts.map

package/dist/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,yhQAsEvB,CAAA"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,+vQAsEvB,CAAA"}

package/dist/skill.js

@@ -26,7 +26,7 @@ market pack scene.zip --out scene.packed.zip
 5. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 6. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
 7. \`generate --type <type> "<prompt>"\` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are \`sound-effect\`, \`background-music\`, \`flipbook\`, \`humanoid-model\`, and \`environment\` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add \`--access public\` to publish the generated asset publicly, or \`--access private\` to keep it owner-only; when omitted the server defaults to private if you hold the \`market:private\` entitlement, else public (\`--access private\` requires that entitlement). \`generate\` waits for the asset and installs it — one command for quick types. For a long one (e.g. \`humanoid-model\`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run \`market generate install <jobId>\` to continue — it resumes the SAME job where the last call left off and installs when ready. Just re-run \`generate install <jobId>\` until it prints "Generated and installed" (it exits 0 while still generating, 1 on failure). No type is flagged "slow" — anything that outlasts one wait just continues on the next call.
-8. Use \`pack <zip>\` to create the same Market asset zip that \`upload\` sends. \`pack\` runs offline, infers template packing from a root \`package.json\`, and accepts \`--type\` only when you need to override that inference. \`upload\` runs the shared pack step internally, then publishes: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags on either command: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template pack/upload also reads root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
+8. Use \`pack <zip>\` to create the same Market asset zip that \`upload\` sends. \`pack\` runs offline, infers template packing from a root \`package.json\`, and accepts \`--type\` only when you need to override that inference. \`upload\` runs the shared pack step internally, then publishes: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags on either command: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template pack/upload also reads root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template pack/upload omits installed dependency files that still match the installed dependency's canonical content (its file hashes are fetched from the server, not stored locally), so edited local files stay in the template; this omit step needs the API, but simple non-template packs stay offline. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
 9. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
 10. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class and Three.js \`KTX2Loader\` for Basis-compressed files; \`market preview\` fetches the middle frame from the flipbook.
 
@@ -63,7 +63,7 @@ Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 
 Assets may also declare \`skill\` dependencies, installed for you via the \`skills\` CLI (\`skills add\`) during \`install\`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires \`npx\` to be available.
 
-Installed non-template assets are saved to \`package.json.assetDependencies\`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in \`.drawcall/market-lock.json\`.
+Installed non-template assets are saved to \`package.json.assetDependencies\`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file paths are recorded in \`.drawcall/market-lock.json\`; file content hashes now come from the server (\`asset.fileManifest\`), not the lock.
 
 \`list\` is offline: it reads \`.drawcall/market-lock.json\` from the nearest package root and prints exact installed names, versions, types, and installed file paths.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawcall/market",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "repository": {
     "type": "git",
     "url": "https://github.com/drawcall-ai/market",

package/skills/market/SKILL.md

@@ -26,7 +26,7 @@ npx @drawcall/market pack scene.zip --out scene.packed.zip
 5. `preview <name>` saves the preview image; no `--type` is needed. Not every type has previews (e.g. `humanoid-animation`, `template`, `sound-effect`, `background-music`); the CLI reports when one is unavailable.
 6. Use `--unapproved` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
 7. `generate --type <type> "<prompt>"` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are `sound-effect`, `background-music`, `flipbook`, `humanoid-model`, and `environment` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add `--access public` to publish the generated asset publicly, or `--access private` to keep it owner-only; when omitted the server defaults to private if you hold the `market:private` entitlement, else public (`--access private` requires that entitlement). `generate` waits for the asset and installs it — one command for quick types. For a long one (e.g. `humanoid-model`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run `market generate install <jobId>` to continue — it resumes the SAME job where the last call left off and installs when ready. Just re-run `generate install <jobId>` until it prints "Generated and installed" (it exits 0 while still generating, 1 on failure). No type is flagged "slow" — anything that outlasts one wait just continues on the next call.
-8. Use `pack <zip>` to create the same Market asset zip that `upload` sends. `pack` runs offline, infers template packing from a root `package.json`, and accepts `--type` only when you need to override that inference. `upload` runs the shared pack step internally, then publishes: `market upload <name> <zip> "<description>" --type <type>`. Declare dependencies with repeatable flags on either command: `--npm name@range`, `--asset name@range`, `--skill label=source`. Use `--access public|private` on upload to set visibility (same default rule as generate): a private asset is visible and installable only by you. Template pack/upload also reads root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match `.drawcall/market-lock.json`, so edited local files stay in the template. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.
+8. Use `pack <zip>` to create the same Market asset zip that `upload` sends. `pack` runs offline, infers template packing from a root `package.json`, and accepts `--type` only when you need to override that inference. `upload` runs the shared pack step internally, then publishes: `market upload <name> <zip> "<description>" --type <type>`. Declare dependencies with repeatable flags on either command: `--npm name@range`, `--asset name@range`, `--skill label=source`. Use `--access public|private` on upload to set visibility (same default rule as generate): a private asset is visible and installable only by you. Template pack/upload also reads root `package.json.assetDependencies`; `--asset` flags are additive and must not conflict. Template pack/upload omits installed dependency files that still match the installed dependency's canonical content (its file hashes are fetched from the server, not stored locally), so edited local files stay in the template; this omit step needs the API, but simple non-template packs stay offline. A skill source is a `skills add` argument: a whole repo (`owner/repo` or a git URL), a single skill via the full URL form `https://github.com/owner/repo/tree/<branch>/<subpath>` (the `tree/<branch>/<subpath>` shorthand needs the full URL, not `owner/repo`), or a local path to a skill directory inside the zip. Example: `market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines`.
 9. Installed `environment` assets contain `public/environment/<name>.hdr` for Three.js IBL lighting and `public/environment/<name>-background.webp` for the visible equirectangular background. Use `market preview` to fetch the preview image separately.
 10. Installed `flipbook` assets contain `public/flipbook/<name>.ktx2`. Render them with `@drawcall/flipbook`'s `Flipbook` class and Three.js `KTX2Loader` for Basis-compressed files; `market preview` fetches the middle frame from the flipbook.
 
@@ -63,7 +63,7 @@ Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 
 Assets may also declare `skill` dependencies, installed for you via the `skills` CLI (`skills add`) during `install`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires `npx` to be available.
 
-Installed non-template assets are saved to `package.json.assetDependencies`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in `.drawcall/market-lock.json`.
+Installed non-template assets are saved to `package.json.assetDependencies`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file paths are recorded in `.drawcall/market-lock.json`; file content hashes now come from the server (`asset.fileManifest`), not the lock.
 
 `list` is offline: it reads `.drawcall/market-lock.json` from the nearest package root and prints exact installed names, versions, types, and installed file paths.
 

package/src/commands/list.ts

@@ -35,7 +35,7 @@ export async function listInstalledAssets(
       name,
       version: asset.version,
       type: asset.type,
-      files: Object.keys(asset.files).sort((a, b) => a.localeCompare(b)),
+      files: [...asset.files].sort((a, b) => a.localeCompare(b)),
     }))
     .sort((a, b) => a.name.localeCompare(b.name))
 

package/src/commands/pack.ts

@@ -1,6 +1,7 @@
 import * as fs from 'fs/promises'
 import * as path from 'path'
 import ora from 'ora'
+import { getCliClient } from '../cli-client.js'
 import { packAsset, packPolicyForType, parsePackDependencies } from '../pack.js'
 import { packResult } from '../output.js'
 import type { AssetType } from '../schemas.js'
@@ -9,6 +10,7 @@ export interface PackCommandOptions {
   type?: AssetType
   cwd?: string
   out?: string
+  baseUrl?: string
   /** npm dependencies, each `name@range` (range defaults to `*`). */
   npm?: string[]
   /** asset dependencies, each `name@range` (range defaults to `*`). */
@@ -26,6 +28,9 @@ export async function packCommand(zipFilter: string, opts: PackCommandOptions):
 
   try {
     const cwd = opts.cwd ?? process.cwd()
+    // A client is only used to omit unchanged installed dependency files (templates); it needs no
+    // auth for public assets and is never called for non-template packs, which stay fully offline.
+    const { client } = await getCliClient({ baseUrl: opts.baseUrl })
     const packed = await packAsset(zipFilter, {
       cwd,
       dependencies: parsePackDependencies({
@@ -34,6 +39,7 @@ export async function packCommand(zipFilter: string, opts: PackCommandOptions):
         skill: opts.skill,
       }),
       policy: packPolicyForType(opts.type),
+      fetchFileManifest: (name, version) => client.asset.fileManifest({ name, version }),
     })
     const out = opts.out ? path.resolve(cwd, opts.out) : defaultPackPath(packed.sourcePath)
 

package/src/commands/upload.ts

@@ -57,6 +57,7 @@ export async function uploadCommand(
       cwd,
       dependencies,
       policy: packPolicyFromInstallMetadata(installMetadata[type]),
+      fetchFileManifest: (name, version) => client.asset.fileManifest({ name, version }),
     })
     const { zip, npmDependencies, assetDependencies, skillDependencies } = packed
     const profile = await client.user.getProfile()

package/src/contract.ts

@@ -1,5 +1,6 @@
 import { oc } from '@orpc/contract'
 import { z } from 'zod'
+import type { AssetFileManifest } from './schemas.js'
 import {
   MAX_UPLOAD_ZIP_SIZE_BYTES,
   agentRunStatusSchema,
@@ -7,6 +8,7 @@ import {
   agentStatusSchema,
   downloadZipSchema,
   exactAssetSchema,
+  fileManifestSchema,
   generateAssetSchema,
   generateJobStatusSchema,
   generateResponseSchema,
@@ -115,6 +117,12 @@ export const contract = {
 
     downloadZip: oc.input(downloadZipSchema).output(z.instanceof(Blob)),
 
+    // The content hashes of a version's files, keyed by install path. Computed once from the stored
+    // source zip and cached, so a caller (e.g. `pack`) can tell whether a local file is an unchanged
+    // copy of an installed asset without keeping any hashes itself. Private assets are owner-only,
+    // same as download.
+    fileManifest: oc.input(fileManifestSchema).output(z.custom<AssetFileManifest>()),
+
     // Generation is a caller-polled job. `generate` starts it and answers immediately: `completed`
     // for fast providers that finish inline, or `pending` with a jobId for slow ones (the humanoid
     // model runs for minutes upstream). `generateStatus` polls that jobId until it settles. Nothing

package/src/index.ts

@@ -61,6 +61,7 @@ export {
   uploadZipSchema,
   downloadZipSchema,
   exactAssetSchema,
+  fileManifestSchema,
   generateAssetSchema,
   updateProfileSchema,
   listAssetsSchema,
@@ -77,6 +78,7 @@ export {
 export type {
   AssetType,
   AssetAccess,
+  AssetFileManifest,
   AgentResultAsset,
   AgentResult,
   AgentRunStatus,

package/src/install.ts

@@ -17,7 +17,7 @@ import { unzipSync } from 'fflate'
 import { detectPackageManager, installDependencies } from 'nypm'
 import type { MarketClient } from './client.js'
 import type { AssetInstallMetadata } from './contract.js'
-import { readMarketLock, sha256, writeMarketLock } from './market-lock.js'
+import { readMarketLock, writeMarketLock } from './market-lock.js'
 import { parsePackageJson, type PackageJson } from './package-json.js'
 import type { ResolveResult } from './resolve.js'
 
@@ -66,12 +66,8 @@ export interface InstallResult {
   warnings: string[]
 }
 
-interface DownloadedAsset extends InstalledAsset {
-  fileHashes: Record<string, { sha256: string }>
-}
-
 interface DownloadResult {
-  assets: DownloadedAsset[]
+  assets: InstalledAsset[]
   wrotePackageJson: boolean
   warnings: string[]
 }
@@ -157,10 +153,8 @@ async function downloadAssets(
     baseUrl?: string
   },
 ): Promise<DownloadResult> {
-  const perAsset = await mapWithConcurrency(
-    resolution.assets,
-    DOWNLOAD_CONCURRENCY,
-    (asset) => downloadOneAsset(client, asset, projectRoot, opts),
+  const perAsset = await mapWithConcurrency(resolution.assets, DOWNLOAD_CONCURRENCY, (asset) =>
+    downloadOneAsset(client, asset, projectRoot, opts),
   )
 
   return {
@@ -177,14 +171,13 @@ async function downloadOneAsset(
   asset: ResolveResult['assets'][number],
   projectRoot: string,
   opts: { force: boolean; log: (msg: string) => void; baseUrl?: string },
-): Promise<{ asset: DownloadedAsset; wrotePackageJson: boolean; warnings: string[] }> {
+): Promise<{ asset: InstalledAsset; wrotePackageJson: boolean; warnings: string[] }> {
   opts.log(`Downloading ${asset.name}@${asset.version}...`)
 
   // Only the network fetch is retried — the download is the sole transient step; unzip and file
   // writes are deterministic local work and a failure there is a real error, not worth re-attempting.
   const files = unzipSync(new Uint8Array(await fetchAssetZipBytes(client, asset, opts)))
   const installedFiles: string[] = []
-  const fileHashes: Record<string, { sha256: string }> = {}
   const warnings: string[] = []
   let wrotePackageJson = false
 
@@ -225,7 +218,6 @@ async function downloadOneAsset(
     }
 
     installedFiles.push(normalizedPath)
-    fileHashes[normalizedPath] = { sha256: sha256(content) }
   }
 
   opts.log(`Downloaded ${installedFiles.length} files from ${asset.name}@${asset.version}.`)
@@ -236,7 +228,6 @@ async function downloadOneAsset(
       version: asset.version,
       description: asset.description,
       files: installedFiles,
-      fileHashes,
     },
     wrotePackageJson,
     warnings,
@@ -262,7 +253,9 @@ async function fetchAssetZipBytes(
         onRetry: (msg) => opts.log(`Downloading ${label} (streaming): ${msg}`),
       })
     } catch (error) {
-      opts.log(`Downloading ${label}: streaming download failed (${errorMessage(error)}); using downloadZip`)
+      opts.log(
+        `Downloading ${label}: streaming download failed (${errorMessage(error)}); using downloadZip`,
+      )
     }
   }
   return withRetry(
@@ -305,9 +298,7 @@ async function mapWithConcurrency<T, R>(
       results[index] = await fn(items[index], index)
     }
   }
-  await Promise.all(
-    Array.from({ length: Math.min(concurrency, items.length) }, () => worker()),
-  )
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()))
   return results
 }
 
@@ -423,14 +414,14 @@ async function runPackageManagerInstall(projectRoot: string, log: (msg: string)
 
 async function writeInstalledAssetLock(
   projectRoot: string,
-  assets: DownloadedAsset[],
+  assets: InstalledAsset[],
 ): Promise<void> {
   const lock = await readMarketLock(projectRoot)
   for (const asset of assets) {
     lock.assets[asset.name] = {
       version: asset.version,
       type: asset.type,
-      files: asset.fileHashes,
+      files: asset.files,
     }
   }
   await writeMarketLock(projectRoot, lock)

package/src/market-lock.ts

@@ -8,7 +8,8 @@ export const MARKET_LOCK_PATH = '.drawcall/market-lock.json'
 export interface MarketLockAsset {
   version: string
   type: string
-  files: Record<string, { sha256: string }>
+  /** Install paths of the asset's files. Content hashes now live on the server (`asset.fileManifest`). */
+  files: string[]
 }
 
 export interface MarketLock {
@@ -16,6 +17,13 @@ export interface MarketLock {
   assets: Record<string, MarketLockAsset>
 }
 
+// Content hashes moved to the server, so the lock records only install paths. It still reads the
+// legacy `{ path: { sha256 } }` shape and normalizes it to a path list, so an existing lock keeps
+// working and is rewritten to the slim form on the next install.
+const filesSchema = z
+  .union([z.array(z.string()), z.record(z.string(), z.object({ sha256: z.string() }))])
+  .transform((files) => (Array.isArray(files) ? files : Object.keys(files)))
+
 const marketLockSchema = z.object({
   version: z.literal(1),
   assets: z.record(
@@ -23,12 +31,7 @@ const marketLockSchema = z.object({
     z.object({
       version: z.string(),
       type: z.string(),
-      files: z.record(
-        z.string(),
-        z.object({
-          sha256: z.string(),
-        }),
-      ),
+      files: filesSchema,
     }),
   ),
 })

package/src/pack.ts

@@ -28,10 +28,18 @@ export interface PackPolicy {
   omitUnchangedInstalledFiles: boolean
 }
 
+export type FetchFileManifest = (name: string, version: string) => Promise<Record<string, string>>
+
 export interface PackAssetOptions {
   cwd?: string
   dependencies: ParsedPackDependencies
   policy?: PackPolicy
+  /**
+   * Fetch the server's content hashes for an installed dependency version (see `asset.fileManifest`),
+   * so a template omits its unchanged installed dependency files. Content hashes are no longer stored
+   * locally, so omitting needs the API — omit this (or a failing fetch) and those files are kept.
+   */
+  fetchFileManifest?: FetchFileManifest
 }
 
 export interface PackedAsset {
@@ -81,7 +89,12 @@ export async function packAsset(zipFilter: string, opts: PackAssetOptions): Prom
   // count means something was dropped; re-zip only then.
   const { kept: withoutIgnored, gitignored } = applyGitignore(sourceFiles)
   const files = policy.omitUnchangedInstalledFiles
-    ? await withoutUnchangedInstalledFiles(withoutIgnored, assetDependencies, cwd)
+    ? await withoutUnchangedInstalledFiles(
+        withoutIgnored,
+        assetDependencies,
+        cwd,
+        opts.fetchFileManifest,
+      )
     : withoutIgnored
 
   const originalCount = Object.keys(sourceFiles).length
@@ -130,17 +143,11 @@ async function packDirectory(dir: string, opts: PackAssetOptions): Promise<Packe
     ...opts.dependencies.npmDependencies,
   }
 
-  // Hashes of installed dependency files, so an unchanged one is dropped after a single read.
-  const hashesByPath = new Map<string, string>()
-  if (policy.omitUnchangedInstalledFiles && Object.keys(assetDependencies).length > 0) {
-    const installRoot = await findInstallRoot(dir)
-    const lock = await readMarketLock(installRoot)
-    for (const [name, asset] of Object.entries(lock.assets)) {
-      if (!(name in assetDependencies)) continue
-      for (const [file, metadata] of Object.entries(asset.files))
-        hashesByPath.set(file, metadata.sha256)
-    }
-  }
+  // Content hashes of installed dependency files (from the server), so an unchanged one is dropped
+  // after a single read.
+  const hashesByPath = policy.omitUnchangedInstalledFiles
+    ? await installedDependencyHashes(dir, assetDependencies, opts.fetchFileManifest)
+    : new Map<string, string>()
 
   const files: Record<string, Uint8Array> = {}
   let omittedInstalled = 0
@@ -366,40 +373,59 @@ function inferPackPolicy(files: Record<string, Uint8Array>): PackPolicy {
   }
 }
 
-// Drop dependency files whose bytes still match what `.drawcall/market-lock.json` recorded as
-// installed, so a template ships only its own (edited or new) files. Returns the surviving entries.
+// Drop dependency files whose bytes still match the installed asset's canonical content, so a
+// template ships only its own (edited or new) files. Returns the surviving entries.
 async function withoutUnchangedInstalledFiles(
   files: Record<string, Uint8Array>,
   assetDependencies: Record<string, string>,
   cwd: string,
+  fetchFileManifest: FetchFileManifest | undefined,
 ): Promise<Record<string, Uint8Array>> {
-  const dependencyNames = new Set(Object.keys(assetDependencies))
-  if (dependencyNames.size === 0) return files
-
-  const installRoot = await findInstallRoot(cwd)
-  const lock = await readMarketLock(installRoot)
-  const hashesByPath = new Map<string, string>()
-
-  for (const [name, asset] of Object.entries(lock.assets)) {
-    if (!dependencyNames.has(name)) continue
-    for (const [file, metadata] of Object.entries(asset.files)) {
-      hashesByPath.set(file, metadata.sha256)
-    }
-  }
-
+  const hashesByPath = await installedDependencyHashes(cwd, assetDependencies, fetchFileManifest)
   if (hashesByPath.size === 0) return files
 
   const kept: Record<string, Uint8Array> = {}
   for (const [file, content] of Object.entries(files)) {
     const normalizedPath = normalizedZipPath(file)
-    const lockedHash = normalizedPath ? hashesByPath.get(normalizedPath) : undefined
-    if (lockedHash && lockedHash === sha256(content)) continue
+    const canonicalHash = normalizedPath ? hashesByPath.get(normalizedPath) : undefined
+    if (canonicalHash && canonicalHash === sha256(content)) continue
     kept[file] = content
   }
 
   return kept
 }
 
+/**
+ * The canonical content hash of every file belonging to a declared asset dependency, keyed by install
+ * path. Read the installed version of each dependency from the lock, then fetch that version's hashes
+ * from the server (`asset.fileManifest`). Returns an empty map when there's nothing to omit or no way
+ * to fetch (offline / no client) — pack then keeps all files rather than guessing.
+ */
+async function installedDependencyHashes(
+  root: string,
+  assetDependencies: Record<string, string>,
+  fetchFileManifest: FetchFileManifest | undefined,
+): Promise<Map<string, string>> {
+  const hashesByPath = new Map<string, string>()
+  const dependencyNames = Object.keys(assetDependencies)
+  if (!fetchFileManifest || dependencyNames.length === 0) return hashesByPath
+
+  const lock = await readMarketLock(await findInstallRoot(root))
+  for (const name of dependencyNames) {
+    const installed = lock.assets[name]
+    if (!installed) continue
+    let manifest: Record<string, string>
+    try {
+      manifest = await fetchFileManifest(name, installed.version)
+    } catch {
+      // Can't reach the server for this dependency — keep its files rather than wrongly omitting them.
+      continue
+    }
+    for (const [file, hash] of Object.entries(manifest)) hashesByPath.set(file, hash)
+  }
+  return hashesByPath
+}
+
 function normalizedZipPath(file: string): string | null {
   const zipPath = file.replace(/\\/g, '/')
   if (

package/src/schemas.ts

@@ -93,6 +93,18 @@ export const downloadZipSchema = z.object({
   version: semverSchema,
 })
 
+export const fileManifestSchema = z.object({
+  name: assetNameSchema,
+  version: semverSchema,
+})
+
+/**
+ * The content hash of every file in an asset version, keyed by its install path — sha256 hex, the
+ * same digest the CLI computes locally. Lets a caller check whether a local file is identical to the
+ * canonical asset without keeping hashes itself (see `pack` omit-unchanged).
+ */
+export type AssetFileManifest = Record<string, string>
+
 export const generateAssetSchema = z.object({
   description: assetDescriptionSchema.min(3),
   type: assetTypeSchema.optional(),

package/src/skill.ts

@@ -26,7 +26,7 @@ market pack scene.zip --out scene.packed.zip
 5. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 6. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
 7. \`generate --type <type> "<prompt>"\` creates and installs a generated asset when that asset type has a generator; it requires login. Currently supported generated types are \`sound-effect\`, \`background-music\`, \`flipbook\`, \`humanoid-model\`, and \`environment\` (a fitting HDRI sky + equirectangular background, generated in ~1-2 min). Generation is provider-specific: prompt style, generated files, indexing fields, and install layout are owned by the asset type. If a type does not support generation yet, the CLI reports unsupported generation. Add \`--access public\` to publish the generated asset publicly, or \`--access private\` to keep it owner-only; when omitted the server defaults to private if you hold the \`market:private\` entitlement, else public (\`--access private\` requires that entitlement). \`generate\` waits for the asset and installs it — one command for quick types. For a long one (e.g. \`humanoid-model\`, >2 min) the call returns after ~2 min with a job id instead of hanging your shell; run \`market generate install <jobId>\` to continue — it resumes the SAME job where the last call left off and installs when ready. Just re-run \`generate install <jobId>\` until it prints "Generated and installed" (it exits 0 while still generating, 1 on failure). No type is flagged "slow" — anything that outlasts one wait just continues on the next call.
-8. Use \`pack <zip>\` to create the same Market asset zip that \`upload\` sends. \`pack\` runs offline, infers template packing from a root \`package.json\`, and accepts \`--type\` only when you need to override that inference. \`upload\` runs the shared pack step internally, then publishes: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags on either command: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template pack/upload also reads root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template pack/upload omits installed dependency files whose hashes still match \`.drawcall/market-lock.json\`, so edited local files stay in the template. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
+8. Use \`pack <zip>\` to create the same Market asset zip that \`upload\` sends. \`pack\` runs offline, infers template packing from a root \`package.json\`, and accepts \`--type\` only when you need to override that inference. \`upload\` runs the shared pack step internally, then publishes: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags on either command: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\`. Template pack/upload also reads root \`package.json.assetDependencies\`; \`--asset\` flags are additive and must not conflict. Template pack/upload omits installed dependency files that still match the installed dependency's canonical content (its file hashes are fetched from the server, not stored locally), so edited local files stay in the template; this omit step needs the API, but simple non-template packs stay offline. A skill source is a \`skills add\` argument: a whole repo (\`owner/repo\` or a git URL), a single skill via the full URL form \`https://github.com/owner/repo/tree/<branch>/<subpath>\` (the \`tree/<branch>/<subpath>\` shorthand needs the full URL, not \`owner/repo\`), or a local path to a skill directory inside the zip. Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines\`.
 9. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
 10. Installed \`flipbook\` assets contain \`public/flipbook/<name>.ktx2\`. Render them with \`@drawcall/flipbook\`'s \`Flipbook\` class and Three.js \`KTX2Loader\` for Basis-compressed files; \`market preview\` fetches the middle frame from the flipbook.
 
@@ -63,7 +63,7 @@ Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 
 Assets may also declare \`skill\` dependencies, installed for you via the \`skills\` CLI (\`skills add\`) during \`install\`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires \`npx\` to be available.
 
-Installed non-template assets are saved to \`package.json.assetDependencies\`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file hashes are recorded in \`.drawcall/market-lock.json\`.
+Installed non-template assets are saved to \`package.json.assetDependencies\`; templates are scaffolds and are not saved as project asset dependencies. Exact installed versions and file paths are recorded in \`.drawcall/market-lock.json\`; file content hashes now come from the server (\`asset.fileManifest\`), not the lock.
 
 \`list\` is offline: it reads \`.drawcall/market-lock.json\` from the nearest package root and prints exact installed names, versions, types, and installed file paths.