@drawcall/market 0.1.98 → 0.2.0

package/dist/v1/contract.js

@@ -0,0 +1,77 @@
+import { oc } from '@orpc/contract';
+import { z } from 'zod';
+import { MAX_UPLOAD_ZIP_SIZE_BYTES, agentRunStatusSchema, agentStartSchema, agentStatusSchema, assetFilesSchema, exactAssetSchema, fileManifestSchema, generateAssetSchema, generateJobStatusSchema, generateResponseSchema, generateStatusInputSchema, listAssetsSchema, updateProfileSchema, uploadZipSchema, } from '../schemas.js';
+/**
+ * The v1 contract: the same procedure tree as the legacy RPC surface (so call sites migrate by
+ * swapping only the client), with HTTP routes attached — served as plain REST under `/api/v1`.
+ * The route annotations here ARE the control-plane URL contract.
+ */
+export const contract = {
+    asset: {
+        search: oc
+            .route({ method: 'GET', path: '/assets' })
+            .input(listAssetsSchema)
+            .output(z.custom()),
+        exact: oc
+            .route({ method: 'GET', path: '/assets/{name}' })
+            .input(exactAssetSchema)
+            .output(z.custom()),
+        // The manifest is new in v1 — it merges the legacy `files` + metadata into one GET.
+        manifest: oc
+            .route({ method: 'GET', path: '/assets/{name}/{version}' })
+            .input(assetFilesSchema)
+            .output(z.custom()),
+        files: oc
+            .route({ method: 'GET', path: '/assets/{name}/{version}/files' })
+            .input(assetFilesSchema)
+            .output(z.custom()),
+        fileManifest: oc
+            .route({ method: 'GET', path: '/assets/{name}/{version}/file-manifest' })
+            .input(fileManifestSchema)
+            .output(z.custom()),
+        uploadZip: oc
+            .route({ method: 'PUT', path: '/assets/{name}/{version}' })
+            .input(uploadZipSchema
+            .extend({ zip: z.instanceof(File) })
+            .refine((input) => input.zip.size < MAX_UPLOAD_ZIP_SIZE_BYTES, {
+            message: 'Upload zip must be smaller than 1 GB',
+            path: ['zip'],
+        }))
+            .output(z.custom()),
+        installMetadata: oc
+            .route({ method: 'GET', path: '/types' })
+            .output(z.custom()),
+        generate: oc
+            .route({ method: 'POST', path: '/generations' })
+            .input(generateAssetSchema)
+            .output(generateResponseSchema),
+        generateStatus: oc
+            .route({ method: 'GET', path: '/generations/{jobId}' })
+            .input(generateStatusInputSchema)
+            .output(generateJobStatusSchema),
+        agent: {
+            start: oc
+                .route({ method: 'POST', path: '/agent-runs' })
+                .input(agentStartSchema)
+                .output(z.object({ runId: z.string() })),
+            status: oc
+                .route({ method: 'GET', path: '/agent-runs/{runId}' })
+                .input(agentStatusSchema)
+                .output(agentRunStatusSchema),
+        },
+    },
+    user: {
+        getProfile: oc.route({ method: 'GET', path: '/me' }).output(z.custom()),
+        updateProfile: oc
+            .route({ method: 'PATCH', path: '/me' })
+            .input(updateProfileSchema)
+            .output(z.custom()),
+        getAuthToken: oc
+            .route({ method: 'GET', path: '/me/auth-token' })
+            .output(z.custom()),
+        createAuthToken: oc
+            .route({ method: 'POST', path: '/me/auth-token' })
+            .output(z.object({ token: z.string(), prefix: z.string() })),
+    },
+};
+//# sourceMappingURL=contract.js.map

package/dist/v1/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/v1/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAWvB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAA;AAuBtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,KAAK,EAAE;QACL,MAAM,EAAE,EAAE;aACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aACzC,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAoC,CAAC;QAEvD,KAAK,EAAE,EAAE;aACN,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aAChD,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAA2B,CAAC;QAE9C,oFAAoF;QACpF,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;aAC1D,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAwB,CAAC;QAE3C,KAAK,EAAE,EAAE;aACN,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;aAChE,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAA+B,CAAC;QAElD,YAAY,EAAE,EAAE;aACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC;aACxE,KAAK,CAAC,kBAAkB,CAAC;aACzB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAqB,CAAC;QAExC,SAAS,EAAE,EAAE;aACV,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;aAC1D,KAAK,CACJ,eAAe;aACZ,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,yBAAyB,EAAE;YAC7D,OAAO,EAAE,sCAAsC;YAC/C,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CACL;aACA,MAAM,CAAC,CAAC,CAAC,MAAM,EAAgB,CAAC;QAEnC,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAwC,CAAC;QAE3D,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aAC/C,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,sBAAsB,CAAC;QAEjC,cAAc,EAAE,EAAE;aACf,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;aACtD,KAAK,CAAC,yBAAyB,CAAC;aAChC,MAAM,CAAC,uBAAuB,CAAC;QAElC,KAAK,EAAE;YACL,KAAK,EAAE,EAAE;iBACN,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;iBAC9C,KAAK,CAAC,gBAAgB,CAAC;iBACvB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,EAAE;iBACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;iBACrD,KAAK,CAAC,iBAAiB,CAAC;iBACxB,MAAM,CAAC,oBAAoB,CAAC;SAChC;KACF;IAED,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAe,CAAC;QAEpF,aAAa,EAAE,EAAE;aACd,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvC,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,EAAQ,CAAC;QAE3B,YAAY,EAAE,EAAE;aACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,MAAM,EAA8C,CAAC;QAEjE,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aACjD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;KAC/D;CACF,CAAA"}

package/dist/v1/index.d.ts

@@ -0,0 +1,3 @@
+export { contract, type V1Contract, type AssetVersionManifest } from './contract.js';
+export { createClient, type MarketV1Client, type MarketV1ClientOptions } from './client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/v1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/v1/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA"}

package/dist/v1/index.js

@@ -0,0 +1,3 @@
+export { contract } from './contract.js';
+export { createClient } from './client.js';
+//# sourceMappingURL=index.js.map

package/dist/v1/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/v1/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA8C,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,YAAY,EAAmD,MAAM,aAAa,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawcall/market",
-  "version": "0.1.98",
+  "version": "0.2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/drawcall-ai/market",
@@ -37,6 +37,7 @@
   "dependencies": {
     "@orpc/client": "^1.0.0",
     "@orpc/contract": "^1.0.0",
+    "@orpc/openapi-client": "1.13.14",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "fflate": "^0.8.2",

package/skills/market/SKILL.md

@@ -31,7 +31,9 @@ Install exact refs together in one call; names need no `--type`:
 
 Install prints the exact files it wrote and records the dependency so packing and later rebuilds can restore it. It never searches or generates. With no refs it installs `assetDependencies` from the nearest `package.json`. Assets may install declared skill dependencies with `npx skills add`. Use `--force` only with permission to overwrite changed local files.
 
-`list --cwd "$PWD"` is an offline, compact inventory from `.drawcall/market-lock.json`. Add `--files` when exact paths for previously installed assets are needed; fresh install and generation already print their paths. When selected refs are already installed, read this inventory instead of reinstalling them.
+`list --cwd "$PWD"` is an offline, compact inventory of the `assetDependencies` in the nearest `package.json`, including file aliases. When selected refs are already installed, read this inventory instead of reinstalling them.
+
+An `assetDependencies` entry is either a range string or `{ "version": "<range>", "alias": { "<canonical path>": "<current path>" } }`. An alias records where the project keeps a renamed installed file: install writes the file at the aliased path, and packing omits exactly that one copy (extra duplicates ship as project content). Run `sync --cwd "$PWD"` after renaming installed files to record aliases in `package.json`; template packing runs the same update automatically.
 
 ## Generate
 
@@ -47,6 +49,6 @@ Add `--access public` or `--access private` when visibility matters. Omitted acc
 
 ## Publish only when asked
 
-Use `pack <source> --out <zip>` to create a Market zip and `upload <name> <source> "<description>" --type <type>` to publish it. Both accept repeatable `--npm name@range`, `--asset name@range`, and `--skill label=source` dependencies. Template packing reads root `assetDependencies` and may use the API to omit unchanged installed dependency files. A skill source is `owner/repo`, a git URL, a full GitHub `tree/<branch>/<subpath>` URL, or a local skill directory inside the zip. Use the command's `--help` for syntax.
+Use `pack <source> --out <zip>` to create a Market zip and `upload <name> <source> "<description>" --type <type>` to publish it. Both accept repeatable `--npm name@range`, `--asset name@range`, and `--skill label=source` dependencies. Template packing reads root `assetDependencies` and may use the API to omit installed dependency files matched by content hash — even when renamed — recording renames as aliases. A skill source is `owner/repo`, a git URL, a full GitHub `tree/<branch>/<subpath>` URL, or a local skill directory inside the zip. Use the command's `--help` for syntax.
 
 Use `--unapproved` only when explicitly requested. Do not install an unapproved asset without acceptance. If login is required, ask before running `npx @drawcall/market login`.

package/src/asset-implementation.ts

@@ -6,7 +6,7 @@ import type {
   GenerateAssetResult,
   PaginatedList,
 } from './contract.js'
-import type { AssetAccess, AssetType, GenerateJobStatus } from './schemas.js'
+import type { AssetAccess, AssetDependencies, AssetType, GenerateJobStatus } from './schemas.js'
 
 export const ASSET_RELEVANCE_SCORE: unique symbol = Symbol('assetRelevanceScore')
 
@@ -38,7 +38,7 @@ export interface AssetUploadZipInput {
   version: string
   description?: string
   npmDependencies: Record<string, string>
-  assetDependencies: Record<string, string>
+  assetDependencies: AssetDependencies
   skillDependencies: Record<string, string>
   tags: string[]
   zip: File
@@ -46,7 +46,7 @@ export interface AssetUploadZipInput {
   access?: AssetAccess
 }
 
-export interface AssetDownloadZipInput {
+export interface AssetVersionRef {
   name: string
   version: string
   /** The asset's capability key, an alternative credential to identity for private/unapproved assets. */

package/src/cli.ts

@@ -13,6 +13,7 @@ import { generateCommand } from './commands/generate.js'
 import { generateInstallCommand } from './commands/generate-install.js'
 import { listCommand } from './commands/list.js'
 import { packCommand } from './commands/pack.js'
+import { syncCommand } from './commands/sync.js'
 import { previewCommand } from './commands/preview.js'
 import { uploadCommand } from './commands/upload.js'
 import { typesCommand } from './commands/types.js'
@@ -125,13 +126,25 @@ program
 
 program
   .command('list')
-  .description('List locally installed assets')
-  .option('--files', 'Include installed file paths', false)
+  .description('List asset dependencies declared in package.json, including file aliases')
   .option('--cwd <dir>', 'Project directory')
-  .action(async (opts: { cwd?: string; files: boolean }) => {
+  .action(async (opts: { cwd?: string }) => {
     await listCommand({
       cwd: opts.cwd,
-      files: opts.files,
+    })
+  })
+
+program
+  .command('sync')
+  .description(
+    'Update package.json assetDependencies aliases to match where installed files live now',
+  )
+  .addOption(apiOption)
+  .option('--cwd <dir>', 'Project directory')
+  .action(async (opts: { api?: string; cwd?: string }) => {
+    await syncCommand({
+      baseUrl: opts.api,
+      cwd: opts.cwd,
     })
   })
 
@@ -176,6 +189,7 @@ program
   .addOption(apiOption)
   .option('--unapproved', 'Include unapproved versions', false)
   .option('--limit <n>', 'Max results, 1-5', parseSearchLimit, 5)
+  .option('--json', 'Emit a machine-readable JSON array instead of the summary lines', false)
   .action(
     async (
       query: string,
@@ -184,6 +198,7 @@ program
         api?: string
         unapproved: boolean
         limit: number
+        json: boolean
       },
     ) => {
       requireType(opts.type, 'Search')
@@ -192,6 +207,7 @@ program
         baseUrl: opts.api,
         unapproved: opts.unapproved,
         limit: opts.limit,
+        json: opts.json,
       })
     },
   )

package/src/client.ts

@@ -26,3 +26,29 @@ export function createMarketClient(opts: MarketClientOptions = {}): MarketClient
   })
   return createORPCClient<MarketClient>(link)
 }
+
+/**
+ * The `GET /download` zip view of a version as bytes. The stream is deterministic (store-mode
+ * entries, fixed mtimes), so two calls for the same immutable version are byte-identical — which is
+ * what upload's "unchanged, skip publishing" check compares against.
+ */
+export async function downloadAssetZipBytes(opts: {
+  name: string
+  version: string
+  baseUrl?: string
+  authToken?: string
+  /** The asset's capability key, an alternative credential to identity for private/unapproved assets. */
+  key?: string
+  fetch?: typeof globalThis.fetch
+}): Promise<Uint8Array> {
+  const url = new URL('/download', opts.baseUrl ?? DEFAULT_BASE_URL)
+  url.searchParams.set('name', opts.name)
+  url.searchParams.set('version', opts.version)
+  if (opts.key) url.searchParams.set('key', opts.key)
+  const doFetch = opts.fetch ?? globalThis.fetch
+  const response = await doFetch(url.toString(), { headers: buildHeaders(opts.authToken) })
+  if (!response.ok) {
+    throw new Error(`Download of ${opts.name}@${opts.version} failed (${response.status})`)
+  }
+  return new Uint8Array(await response.arrayBuffer())
+}

package/src/commands/install.ts

@@ -4,7 +4,7 @@ import ora from 'ora'
 import { resolve } from '../resolve.js'
 import { findInstallRoot, install as runInstall, type InstallRootRequest } from '../install.js'
 import { packageJsonAssetDependencies } from '../package-json.js'
-import { assetNameSchema } from '../schemas.js'
+import { assetDependencyRange, assetNameSchema, type AssetDependencies } from '../schemas.js'
 import { getCliClient } from '../cli-client.js'
 import { installResult } from '../output.js'
 import type { MarketClient } from '../client.js'
@@ -125,12 +125,15 @@ async function packageJsonRequests(cwd: string | undefined): Promise<AssetReques
   const installRoot = await findInstallRoot(cwd ?? process.cwd())
   const pkgPath = path.join(installRoot, 'package.json')
   const dependencies = await readPackageJsonAssetDependencies(pkgPath)
-  const requests = Object.entries(dependencies).map(([name, range]) => ({
-    name,
-    range,
-    saveRange: range,
-    save: false,
-  }))
+  const requests = Object.entries(dependencies).map(([name, value]) => {
+    const range = assetDependencyRange(value)
+    return {
+      name,
+      range,
+      saveRange: range,
+      save: false,
+    }
+  })
 
   if (requests.length === 0) {
     throw new Error(
@@ -141,7 +144,7 @@ async function packageJsonRequests(cwd: string | undefined): Promise<AssetReques
   return requests
 }
 
-async function readPackageJsonAssetDependencies(pkgPath: string): Promise<Record<string, string>> {
+async function readPackageJsonAssetDependencies(pkgPath: string): Promise<AssetDependencies> {
   try {
     return packageJsonAssetDependencies(await fs.readFile(pkgPath, 'utf-8'), pkgPath)
   } catch (error) {

package/src/commands/list.ts

@@ -1,48 +1,62 @@
+import * as fs from 'fs/promises'
 import * as path from 'path'
 import { findInstallRoot } from '../install.js'
-import { MARKET_LOCK_PATH, readMarketLock } from '../market-lock.js'
+import { packageJsonAssetDependencies } from '../package-json.js'
+import { assetDependencyAlias, assetDependencyRange } from '../schemas.js'
 import { listResult } from '../output.js'
 
 export interface ListCommandOptions {
   cwd?: string
-  files?: boolean
 }
 
 export interface InstalledAssetListing {
   name: string
-  version: string
-  type: string
-  files: string[]
+  range: string
+  /** Canonical install path → the project's current path, for files renamed after install. */
+  alias: Record<string, string>
 }
 
 export interface ListInstalledAssetsResult {
   projectRoot: string
-  lockPath: string
+  packageJsonPath: string
   assets: InstalledAssetListing[]
 }
 
 export async function listCommand(opts: ListCommandOptions): Promise<void> {
   const result = await listInstalledAssets(opts.cwd)
-  console.log(listResult(result, { files: opts.files }))
+  console.log(listResult(result))
 }
 
+/** The project's declared asset dependencies — package.json is the single source of truth. */
 export async function listInstalledAssets(
   cwd: string | undefined,
 ): Promise<ListInstalledAssetsResult> {
   const projectRoot = await findInstallRoot(cwd ?? process.cwd())
-  const lock = await readMarketLock(projectRoot)
-  const assets = Object.entries(lock.assets)
-    .map(([name, asset]) => ({
+  const packageJsonPath = path.join(projectRoot, 'package.json')
+  const dependencies = await readAssetDependencies(packageJsonPath)
+  const assets = Object.entries(dependencies)
+    .map(([name, value]) => ({
       name,
-      version: asset.version,
-      type: asset.type,
-      files: [...asset.files].sort((a, b) => a.localeCompare(b)),
+      range: assetDependencyRange(value),
+      alias: assetDependencyAlias(value),
     }))
     .sort((a, b) => a.name.localeCompare(b.name))
 
   return {
     projectRoot,
-    lockPath: path.join(projectRoot, MARKET_LOCK_PATH),
+    packageJsonPath,
     assets,
   }
 }
+
+async function readAssetDependencies(packageJsonPath: string) {
+  try {
+    return packageJsonAssetDependencies(
+      await fs.readFile(packageJsonPath, 'utf-8'),
+      packageJsonPath,
+    )
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return {}
+    throw error
+  }
+}

package/src/commands/pack.ts

@@ -2,7 +2,12 @@ import * as fs from 'fs/promises'
 import * as path from 'path'
 import ora from 'ora'
 import { getCliClient } from '../cli-client.js'
-import { packAsset, packPolicyForType, parsePackDependencies } from '../pack.js'
+import {
+  fileManifestForRange,
+  packAsset,
+  packPolicyForType,
+  parsePackDependencies,
+} from '../pack.js'
 import { packResult } from '../output.js'
 import type { AssetType } from '../schemas.js'
 
@@ -39,7 +44,7 @@ export async function packCommand(zipFilter: string, opts: PackCommandOptions):
         skill: opts.skill,
       }),
       policy: packPolicyForType(opts.type),
-      fetchFileManifest: (name, version) => client.asset.fileManifest({ name, version }),
+      fetchFileManifest: fileManifestForRange(client.asset),
     })
     const out = opts.out ? path.resolve(cwd, opts.out) : defaultPackPath(packed.sourcePath)
 

package/src/commands/search.ts

@@ -10,6 +10,8 @@ export interface SearchCommandOptions {
   unapproved?: boolean
   baseUrl?: string
   limit?: number
+  /** Emit a machine-readable JSON array instead of the human-readable lines. */
+  json?: boolean
 }
 
 export async function searchCommand(query: string, opts: SearchCommandOptions): Promise<void> {
@@ -17,8 +19,8 @@ export async function searchCommand(query: string, opts: SearchCommandOptions):
 
   const spinner = ora({
     text: `Searching "${query}"`,
-    isEnabled: Boolean(process.stderr.isTTY),
-    isSilent: !process.stderr.isTTY,
+    isEnabled: Boolean(process.stderr.isTTY) && !opts.json,
+    isSilent: !process.stderr.isTTY || Boolean(opts.json),
   }).start()
   const results = await client.asset
     .search({
@@ -31,6 +33,23 @@ export async function searchCommand(query: string, opts: SearchCommandOptions):
     })
     .finally(() => spinner.stop())
 
+  if (opts.json) {
+    // Stable machine-readable shape for scripts; the human-readable lines below may change freely.
+    console.log(
+      JSON.stringify(
+        results.items.map((item) => ({
+          name: item.name,
+          version: item.latestVersion,
+          type: item.type,
+          approved: item.approved,
+          access: item.access,
+          description: item.description,
+        })),
+      ),
+    )
+    return
+  }
+
   console.log(
     searchSummary({
       query,

package/src/commands/sync.ts

@@ -0,0 +1,30 @@
+import ora from 'ora'
+import { getCliClient } from '../cli-client.js'
+import { fileManifestForRange, syncAssetDependencies } from '../pack.js'
+import { syncResult } from '../output.js'
+
+export interface SyncCommandOptions {
+  cwd?: string
+  baseUrl?: string
+}
+
+export async function syncCommand(opts: SyncCommandOptions): Promise<void> {
+  const spinner = ora({
+    text: 'Syncing assetDependencies',
+    isEnabled: Boolean(process.stderr.isTTY),
+    isSilent: !process.stderr.isTTY,
+  }).start()
+
+  try {
+    const { client } = await getCliClient({ baseUrl: opts.baseUrl })
+    const result = await syncAssetDependencies(
+      opts.cwd ?? process.cwd(),
+      fileManifestForRange(client.asset),
+    )
+    spinner.stop()
+    console.log(syncResult(result))
+  } catch (err) {
+    spinner.stop()
+    throw err
+  }
+}

package/src/commands/upload.ts

@@ -1,7 +1,13 @@
 import ora from 'ora'
 import semver from 'semver'
+import { downloadAssetZipBytes } from '../client.js'
 import { getCliClient } from '../cli-client.js'
-import { packAsset, packPolicyFromInstallMetadata, parsePackDependencies } from '../pack.js'
+import {
+  fileManifestForRange,
+  packAsset,
+  packPolicyFromInstallMetadata,
+  parsePackDependencies,
+} from '../pack.js'
 import { unchangedUploadResult, uploadResult } from '../output.js'
 import {
   assetDescriptionSchema,
@@ -51,13 +57,16 @@ export async function uploadCommand(
     })
     const cwd = opts.cwd ?? process.cwd()
     const type = opts.type
-    const { client } = await getCliClient({ baseUrl: opts.baseUrl, requireAuth: true })
+    const { client, baseUrl, authToken } = await getCliClient({
+      baseUrl: opts.baseUrl,
+      requireAuth: true,
+    })
     const installMetadata = await client.asset.installMetadata()
     const packed = await packAsset(zipFilter, {
       cwd,
       dependencies,
       policy: packPolicyFromInstallMetadata(installMetadata[type]),
-      fetchFileManifest: (name, version) => client.asset.fileManifest({ name, version }),
+      fetchFileManifest: fileManifestForRange(client.asset),
     })
     const { zip, npmDependencies, assetDependencies, skillDependencies } = packed
     const profile = await client.user.getProfile()
@@ -75,11 +84,12 @@ export async function uploadCommand(
     }
 
     if (existing) {
-      const latestZip = await client.asset.downloadZip({
+      const latestBytes = await downloadAssetZipBytes({
         name: parsedName,
         version: existing.latestVersion,
+        baseUrl,
+        authToken,
       })
-      const latestBytes = new Uint8Array(await latestZip.arrayBuffer())
       if (
         existing.description === parsedDescription &&
         depsEqual(existing.npmDependencies, npmDependencies) &&
@@ -128,16 +138,21 @@ export function parseUploadDescription(description: string): string {
   }
 }
 
-/** Compare a stored dependency JSON string against a freshly parsed record. */
-function depsEqual(storedJson: string, next: Record<string, string>): boolean {
-  let stored: Record<string, string>
+/** Compare a stored dependency JSON string against a freshly parsed record. Values may be nested
+ *  (asset dependencies carry `{ version, alias }`), so equality is structural with sorted keys. */
+function depsEqual(storedJson: string, next: Record<string, unknown>): boolean {
   try {
-    stored = JSON.parse(storedJson || '{}') as Record<string, string>
+    return stableJson(JSON.parse(storedJson || '{}')) === stableJson(next)
   } catch {
     return false
   }
-  const keys = Object.keys(stored)
-  return keys.length === Object.keys(next).length && keys.every((key) => stored[key] === next[key])
+}
+
+function stableJson(value: unknown): string {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return JSON.stringify(value)
+  const record = value as Record<string, unknown>
+  const keys = Object.keys(record).sort()
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(',')}}`
 }
 
 function nextVersion(latest?: string): string {

package/src/contract.ts

@@ -7,7 +7,6 @@ import {
   agentStartSchema,
   agentStatusSchema,
   assetFilesSchema,
-  downloadZipSchema,
   exactAssetSchema,
   fileManifestSchema,
   generateAssetSchema,
@@ -147,8 +146,6 @@ export const contract = {
       )
       .output(z.custom<AssetVersion>()),
 
-    downloadZip: oc.input(downloadZipSchema).output(z.instanceof(Blob)),
-
     // The derived file index of a version — every stored file's path, size and md5 etag plus the
     // fetch-ready data-plane URLs, so installs fetch files in parallel through the same edge cache
     // browsers warm.

package/src/index.ts

@@ -1,5 +1,9 @@
+// The v1 REST surface (`/api/v1`): routed contract + typed client. Prefer this; the legacy RPC
+// client below is deprecated and retires together with `/api/rpc`.
+export * as v1 from './v1/index.js'
+
 // Client
-export { createMarketClient } from './client.js'
+export { createMarketClient, downloadAssetZipBytes } from './client.js'
 export type { MarketClient, MarketClientOptions } from './client.js'
 
 // Contracts
@@ -21,7 +25,7 @@ export type {
 } from './contract.js'
 
 export type {
-  AssetDownloadZipInput,
+  AssetVersionRef,
   AssetExactInput,
   AssetGenerateInput,
   AssetImplementation,
@@ -62,9 +66,13 @@ export {
   assetAccessSchema,
   npmDependenciesSchema,
   assetDependenciesSchema,
+  assetDependencyAliasSchema,
+  assetDependencyValueSchema,
+  assetDependencyRange,
+  assetDependencyAlias,
+  assetDependencyValue,
   skillDependenciesSchema,
   uploadZipSchema,
-  downloadZipSchema,
   exactAssetSchema,
   fileManifestSchema,
   generateAssetSchema,
@@ -83,6 +91,8 @@ export {
 export type {
   AssetType,
   AssetAccess,
+  AssetDependencies,
+  AssetDependencyValue,
   AssetFileManifest,
   AgentResultAsset,
   AgentResult,