@drawcall/market 0.1.77 → 0.1.80

package/src/install.ts

@@ -11,12 +11,13 @@
  */
 
 import { execFile } from 'child_process'
+import { createHash } from 'crypto'
 import * as fs from 'fs/promises'
 import * as path from 'path'
 import { unzipSync } from 'fflate'
 import { detectPackageManager, installDependencies } from 'nypm'
 import type { MarketClient } from './client.js'
-import type { AssetInstallMetadata } from './contract.js'
+import type { AssetFilesResult, AssetInstallMetadata } from './contract.js'
 import { withProjectInstallLock } from './install-lock.js'
 import { readMarketLock, writeMarketLock } from './market-lock.js'
 import { parsePackageJson, type PackageJson } from './package-json.js'
@@ -31,11 +32,13 @@ export interface InstallOptions {
   rootRequests?: InstallRootRequest[]
   /** Asset-type install policy from the Market API. */
   installMetadata?: Record<string, AssetInstallMetadata>
-  /** Market API origin (e.g. https://api.market.drawcall.ai). When set, asset zips are fetched from
-   *  the Worker's streaming `/download` route instead of the buffering oRPC `downloadZip`. */
+  /** Market API origin (e.g. https://market.drawcall.ai). When set, the zip fallback is fetched
+   *  from the Worker's streaming `/download` route instead of the buffering oRPC `downloadZip`. */
   baseUrl?: string
   /** Bearer token for owner-only assets downloaded through the streaming route. */
   authToken?: string
+  /** Capability key of a shared private asset (`market install <asset> --key <key>`). */
+  key?: string
   /** Log progress */
   onProgress?: (message: string) => void
   /**
@@ -82,6 +85,7 @@ interface DownloadOptions {
   log: (message: string) => void
   baseUrl?: string
   authToken?: string
+  key?: string
 }
 
 export async function install(
@@ -98,6 +102,7 @@ export async function install(
     log,
     baseUrl: opts.baseUrl,
     authToken: opts.authToken,
+    key: opts.key,
   })
   const integration = await withProjectInstallLock(
     installRoot,
@@ -188,14 +193,14 @@ async function downloadOneAsset(
 ): Promise<{ asset: InstalledAsset; wrotePackageJson: boolean; warnings: string[] }> {
   opts.log(`Downloading ${asset.name}@${asset.version}...`)
 
-  // Only the network fetch is retried — the download is the sole transient step; unzip and file
-  // writes are deterministic local work and a failure there is a real error, not worth re-attempting.
-  const files = unzipSync(new Uint8Array(await fetchAssetZipBytes(client, asset, opts)))
+  // Only the network fetches are retried — downloads are the sole transient step; file writes are
+  // deterministic local work and a failure there is a real error, not worth re-attempting.
+  const files = await fetchAssetEntries(client, asset, opts)
   const installedFiles: string[] = []
   const warnings: string[] = []
   let wrotePackageJson = false
 
-  for (const [relativePath, content] of Object.entries(files) as [string, Uint8Array][]) {
+  for (const [relativePath, content] of files) {
     const zipPath = relativePath.replace(/\\/g, '/')
     if (
       zipPath.split('/').includes('..') ||
@@ -248,6 +253,82 @@ async function downloadOneAsset(
   }
 }
 
+/** Files fetched in flight per asset. Assets themselves download 8-wide, so this bounds total
+ *  connections at 8×4 against edge-cached objects — cheap for the CDN, fast for the install. */
+const FILE_DOWNLOAD_CONCURRENCY = 4
+
+/**
+ * A version's files: fetched per file from the data plane (parallel, md5-verified against R2
+ * etags, through the same edge cache browsers warm), or by unzipping the zip view when the server
+ * or version predates unpacked storage.
+ */
+async function fetchAssetEntries(
+  client: MarketClient,
+  asset: ResolveResult['assets'][number],
+  opts: DownloadOptions,
+): Promise<Array<[string, Uint8Array]>> {
+  const index = await fetchFileIndex(client, asset, opts)
+  if (!index) {
+    const zip = unzipSync(new Uint8Array(await fetchAssetZipBytes(client, asset, opts)))
+    return Object.entries(zip)
+  }
+
+  const label = `${asset.name}@${asset.version}`
+  return mapWithConcurrency(index.files, FILE_DOWNLOAD_CONCURRENCY, async (file) => {
+    const bytes = await withRetry(() => fetchVerifiedFile(index, file), {
+      attempts: DOWNLOAD_ATTEMPTS,
+      onRetry: (msg) => opts.log(`Downloading ${label} ${file.path}: ${msg}`),
+    })
+    return [file.path, bytes] as [string, Uint8Array]
+  })
+}
+
+/**
+ * The derived file index of a version, or null when the zip view must cover it: a NOT_FOUND means
+ * the server predates `asset.files` or the version is not yet backfilled — both transitional
+ * states the migration's Contract phase retires.
+ */
+async function fetchFileIndex(
+  client: MarketClient,
+  asset: ResolveResult['assets'][number],
+  opts: DownloadOptions,
+): Promise<AssetFilesResult | null> {
+  try {
+    return await client.asset.files({
+      name: asset.name,
+      version: asset.version,
+      ...(opts.key ? { key: opts.key } : {}),
+    })
+  } catch (error) {
+    if ((error as { status?: unknown } | null)?.status === 404) return null
+    throw error
+  }
+}
+
+async function fetchVerifiedFile(
+  index: AssetFilesResult,
+  file: AssetFilesResult['files'][number],
+): Promise<Uint8Array> {
+  const url = new URL(encodeSubpath(file.path), index.baseUrl)
+  if (index.key) url.searchParams.set('key', index.key)
+  const res = await fetch(url)
+  if (!res.ok) {
+    throw Object.assign(new Error(`file download responded ${res.status}`), { status: res.status })
+  }
+  const bytes = new Uint8Array(await res.arrayBuffer())
+  // A digest mismatch is a corrupt transfer; thrown without a status so withRetry treats it as
+  // transient and re-fetches.
+  const md5 = createHash('md5').update(bytes).digest('hex')
+  if (md5 !== file.etag) {
+    throw new Error(`md5 mismatch for ${file.path}: expected ${file.etag}, got ${md5}`)
+  }
+  return bytes
+}
+
+function encodeSubpath(subpath: string): string {
+  return subpath.split('/').map(encodeURIComponent).join('/')
+}
+
 /** Fetch an asset's source-zip bytes. The CLI uses the Worker's streaming `/download` route so a
  *  large zip never has to fit in Worker memory. Library callers without a base URL use the typed
  *  client route. Both paths retry transient failures and surface a final failure unchanged. */
@@ -258,7 +339,7 @@ async function fetchAssetZipBytes(
 ): Promise<ArrayBuffer> {
   const label = `${asset.name}@${asset.version}`
   if (opts.baseUrl) {
-    const url = assetDownloadUrl(opts.baseUrl, asset)
+    const url = assetDownloadUrl(opts.baseUrl, asset, opts.key)
     return withRetry(() => fetchZipFromUrl(url, opts.authToken), {
       attempts: DOWNLOAD_ATTEMPTS,
       onRetry: (msg) => opts.log(`Downloading ${label} (streaming): ${msg}`),
@@ -267,17 +348,26 @@ async function fetchAssetZipBytes(
   return withRetry(
     () =>
       client.asset
-        .downloadZip({ name: asset.name, version: asset.version })
+        .downloadZip({
+          name: asset.name,
+          version: asset.version,
+          ...(opts.key ? { key: opts.key } : {}),
+        })
         .then((blob) => blob.arrayBuffer()),
     { attempts: DOWNLOAD_ATTEMPTS, onRetry: (msg) => opts.log(`Downloading ${label}: ${msg}`) },
   )
 }
 
-/** The Worker's streaming-download URL for an asset (`GET /download?name&version`). */
-function assetDownloadUrl(baseUrl: string, asset: ResolveResult['assets'][number]): string {
+/** The Worker's streaming-download URL for an asset (`GET /download?name&version[&key]`). */
+function assetDownloadUrl(
+  baseUrl: string,
+  asset: ResolveResult['assets'][number],
+  key?: string,
+): string {
   const url = new URL('/download', baseUrl)
   url.searchParams.set('name', asset.name)
   url.searchParams.set('version', asset.version)
+  if (key) url.searchParams.set('key', key)
   return url.href
 }
 

package/src/resolve.ts

@@ -60,7 +60,7 @@ export class ResolutionError extends Error {
 export async function resolve(
   client: MarketClient['asset'],
   requests: AssetRequest[],
-  opts: { includeUnapproved?: boolean } = {},
+  opts: { includeUnapproved?: boolean; key?: string } = {},
 ): Promise<ResolveResult> {
   const metaCache = new Map<string, AssetExactResult>()
   const includeUnapproved = opts.includeUnapproved ?? false
@@ -76,7 +76,14 @@ export async function resolve(
     }
     seenPinSets.add(signature)
 
-    const result = await resolvePass(client, requests, exactPins, includeUnapproved, metaCache)
+    const result = await resolvePass(
+      client,
+      requests,
+      exactPins,
+      includeUnapproved,
+      metaCache,
+      opts.key,
+    )
     const nextPins = exactPinsFor(result.constraints)
     if (!samePins(exactPins, nextPins)) {
       exactPins = nextPins
@@ -103,6 +110,7 @@ async function resolvePass(
   initialPins: ExactPins,
   includeUnapproved: boolean,
   metaCache: Map<string, AssetExactResult>,
+  key?: string,
 ): Promise<ResolutionPass> {
   const constraints = rootConstraints(requests)
   const resolved = new Map<string, ResolvedAsset>()
@@ -114,7 +122,7 @@ async function resolvePass(
 
     const constrainedExact = requiredExactVersion(assetName, constraints.get(assetName) ?? [])
     const exactVersion = constrainedExact ?? initialPins.get(assetName) ?? null
-    const meta = await fetchMeta(client, metaCache, assetName, exactVersion, includeUnapproved)
+    const meta = await fetchMeta(client, metaCache, assetName, exactVersion, includeUnapproved, key)
     if (!meta) {
       if (exactVersion) {
         throw new ResolutionError(
@@ -252,14 +260,18 @@ async function fetchMeta(
   name: string,
   version: string | null,
   includeUnapproved: boolean,
+  key?: string,
 ): Promise<AssetExactResult | null> {
   const cacheKey = version ? `${name}@${version}` : name
   const cached = cache.get(cacheKey)
   if (cached) return cached
+  // The key is sent with every lookup in the tree; it only unlocks the asset it belongs to and is
+  // inert for the rest, so no per-asset routing is needed.
   const meta = await client.exact({
     name,
     ...(version ? { version } : {}),
     includeUnapproved,
+    ...(key ? { key } : {}),
   })
   if (meta) cache.set(cacheKey, meta)
   return meta

package/src/schemas.ts

@@ -68,11 +68,17 @@ export const listAssetsSchema = z.object({
   sort: z.enum(['newest', 'alphabetical', 'relevance']).default('newest'),
 })
 
+// An asset's capability key — the `?key=` suffix that unlocks a private (or unapproved) asset's
+// files and preview on the data plane. Accepted by exact reads as an alternative credential to
+// identity, so "sharing an asset" is sharing this one string.
+export const accessKeySchema = z.string().min(1).max(128)
+
 export const exactAssetSchema = z.object({
   name: assetNameSchema,
   type: assetTypeSchema.optional(),
   version: semverSchema.optional(),
   includeUnapproved: z.boolean().default(false),
+  key: accessKeySchema.optional(),
 })
 
 export const uploadZipSchema = z.object({
@@ -92,6 +98,15 @@ export const uploadZipSchema = z.object({
 export const downloadZipSchema = z.object({
   name: assetNameSchema,
   version: semverSchema,
+  key: accessKeySchema.optional(),
+})
+
+// Input of `asset.files`: the derived file index of a version, for per-file installs from the data
+// plane. Same credential rules as downloadZip.
+export const assetFilesSchema = z.object({
+  name: assetNameSchema,
+  version: semverSchema,
+  key: accessKeySchema.optional(),
 })
 
 export const fileManifestSchema = z.object({