@drawcall/market 0.1.98 → 0.2.0

package/src/install.ts

@@ -18,9 +18,9 @@ import { detectPackageManager, installDependencies } from 'nypm'
 import type { MarketClient } from './client.js'
 import type { AssetFilesResult, AssetInstallMetadata } from './contract.js'
 import { withProjectInstallLock } from './install-lock.js'
-import { readMarketLock, writeMarketLock } from './market-lock.js'
-import { parsePackageJson, type PackageJson } from './package-json.js'
+import { packageJsonAssetDependencies, parsePackageJson, type PackageJson } from './package-json.js'
 import type { ResolveResult } from './resolve.js'
+import { assetDependencyAlias, assetDependencyRange, assetDependencyValue } from './schemas.js'
 
 export interface InstallOptions {
   /** Directory to start project root discovery from (default: cwd) */
@@ -78,6 +78,8 @@ interface DownloadOptions {
   force: boolean
   log: (message: string) => void
   key?: string
+  /** File aliases per asset name: canonical install path → the project's current path for it. */
+  aliases: Record<string, Record<string, string>>
 }
 
 export async function install(
@@ -89,15 +91,16 @@ export async function install(
   const installRoot = await findInstallRoot(opts.cwd ?? process.cwd())
   const metadata = opts.installMetadata ?? {}
 
+  const aliases = await projectAssetAliases(installRoot, resolution)
   const download = await downloadAssets(client, resolution, installRoot, {
     force: opts.force ?? false,
     log,
     key: opts.key,
+    aliases,
   })
   const integration = await withProjectInstallLock(
     installRoot,
     async () => {
-      await writeInstalledAssetLock(installRoot, download.assets)
       const packageJsonUpdate = await updatePackageJson(resolution, installRoot, {
         rootRequests: opts.rootRequests ?? [],
         installMetadata: metadata,
@@ -186,21 +189,16 @@ async function downloadOneAsset(
   // Only the network fetches are retried — downloads are the sole transient step; file writes are
   // deterministic local work and a failure there is a real error, not worth re-attempting.
   const files = await fetchAssetEntries(client, asset, opts)
+  const alias = opts.aliases[asset.name] ?? {}
   const installedFiles: string[] = []
   const warnings: string[] = []
   let wrotePackageJson = false
 
   for (const [relativePath, content] of files) {
-    const zipPath = relativePath.replace(/\\/g, '/')
-    if (
-      zipPath.split('/').includes('..') ||
-      path.posix.isAbsolute(zipPath) ||
-      path.win32.isAbsolute(zipPath)
-    ) {
-      throw new Error(`Zip contains an unsafe path: ${relativePath}`)
-    }
-
-    const normalizedPath = path.posix.normalize(zipPath)
+    const normalizedPath = safeRelativePath(
+      relativePath,
+      () => `Zip contains an unsafe path: ${relativePath}`,
+    )
     if (
       normalizedPath === '.' ||
       (normalizedPath === 'README.md' && asset.type !== 'template') ||
@@ -209,11 +207,22 @@ async function downloadOneAsset(
       continue
     }
 
-    const filePath = path.join(projectRoot, normalizedPath)
+    // An alias redirects the file to where this project keeps it (a rename recorded by pack or a
+    // dependent asset). Alias targets come from metadata, so they pass the same traversal guard.
+    const aliased = alias[normalizedPath]
+    const targetPath =
+      aliased === undefined
+        ? normalizedPath
+        : safeRelativePath(
+            aliased,
+            () => `Alias for ${normalizedPath} in ${asset.name} is an unsafe path: ${aliased}`,
+          )
+
+    const filePath = path.join(projectRoot, targetPath)
     const existing = await maybeReadFile(filePath)
     if (existing && !bytesEqual(existing, content) && !opts.force) {
       warnings.push(
-        `Skipped ${normalizedPath} from ${asset.name}@${asset.version}; file already exists. Re-run with --force to overwrite.`,
+        `Skipped ${targetPath} from ${asset.name}@${asset.version}; file already exists. Re-run with --force to overwrite.`,
       )
       continue
     }
@@ -221,12 +230,12 @@ async function downloadOneAsset(
     if (!existing || !bytesEqual(existing, content)) {
       await fs.mkdir(path.dirname(filePath), { recursive: true })
       await fs.writeFile(filePath, content)
-      if (normalizedPath === 'package.json') {
+      if (targetPath === 'package.json') {
         wrotePackageJson = true
       }
     }
 
-    installedFiles.push(normalizedPath)
+    installedFiles.push(targetPath)
   }
 
   opts.log(`Downloaded ${installedFiles.length} files from ${asset.name}@${asset.version}.`)
@@ -243,6 +252,46 @@ async function downloadOneAsset(
   }
 }
 
+/** Validate + normalize a posix-relative install path; throws `message()` on traversal/absolute. */
+function safeRelativePath(candidate: string, message: () => string): string {
+  const posixPath = candidate.replace(/\\/g, '/')
+  if (
+    posixPath.split('/').includes('..') ||
+    path.posix.isAbsolute(posixPath) ||
+    path.win32.isAbsolute(posixPath)
+  ) {
+    throw new Error(message())
+  }
+  return path.posix.normalize(posixPath)
+}
+
+/**
+ * File aliases per asset, merged from the project's own package.json `assetDependencies` and the
+ * aliases dependents declared in their metadata. The project's entries win: the user's local
+ * layout beats what a template recorded at publish time.
+ */
+async function projectAssetAliases(
+  projectRoot: string,
+  resolution: ResolveResult,
+): Promise<Record<string, Record<string, string>>> {
+  const merged: Record<string, Record<string, string>> = {}
+  for (const [name, alias] of Object.entries(resolution.assetAliases ?? {})) {
+    merged[name] = { ...alias }
+  }
+
+  const pkgPath = path.join(projectRoot, 'package.json')
+  const pkgJson = await maybeReadFile(pkgPath)
+  if (!pkgJson) return merged
+
+  const declared = packageJsonAssetDependencies(new TextDecoder().decode(pkgJson), pkgPath)
+  for (const [name, value] of Object.entries(declared)) {
+    const alias = assetDependencyAlias(value)
+    if (Object.keys(alias).length === 0) continue
+    merged[name] = { ...(merged[name] ?? {}), ...alias }
+  }
+  return merged
+}
+
 /** Files fetched in flight per asset. Assets themselves download 8-wide, so this bounds total
  *  connections at 8×4 against edge-cached objects — cheap for the CDN, fast for the install. */
 const FILE_DOWNLOAD_CONCURRENCY = 4
@@ -396,7 +445,7 @@ async function updatePackageJson(
     opts.rootRequests,
     opts.installMetadata,
   )
-  if (mergeRecord(pkg, 'assetDependencies', assetDependencies)) {
+  if (mergeAssetDependencyRanges(pkg, assetDependencies)) {
     changed = true
   }
 
@@ -417,28 +466,13 @@ async function runPackageManagerInstall(projectRoot: string, log: (msg: string)
   log('npm dependencies installed.')
 }
 
-async function writeInstalledAssetLock(
-  projectRoot: string,
-  assets: InstalledAsset[],
-): Promise<void> {
-  const lock = await readMarketLock(projectRoot)
-  for (const asset of assets) {
-    lock.assets[asset.name] = {
-      version: asset.version,
-      type: asset.type,
-      files: asset.files,
-    }
-  }
-  await writeMarketLock(projectRoot, lock)
-}
-
 function defaultPackageJson(): PackageJson {
   return { name: 'my-project', private: true, dependencies: {} }
 }
 
 function mergeRecord(
   pkg: PackageJson,
-  field: 'dependencies' | 'assetDependencies',
+  field: 'dependencies',
   values: Record<string, string>,
 ): boolean {
   const entries = Object.entries(values)
@@ -448,7 +482,7 @@ function mergeRecord(
   let changed = false
 
   for (const [name, range] of entries) {
-    if (field === 'dependencies' && name.startsWith('@drawcall/') && current[name] === 'latest') {
+    if (name.startsWith('@drawcall/') && current[name] === 'latest') {
       continue
     }
     if (current[name] === range) continue
@@ -460,6 +494,26 @@ function mergeRecord(
   return changed
 }
 
+/** Merge saved ranges into `assetDependencies`, preserving any aliases an entry already carries. */
+function mergeAssetDependencyRanges(pkg: PackageJson, values: Record<string, string>): boolean {
+  const entries = Object.entries(values)
+  if (entries.length === 0) return false
+
+  const current = pkg.assetDependencies ?? {}
+  let changed = false
+
+  for (const [name, range] of entries) {
+    const existing = current[name]
+    if (existing !== undefined && assetDependencyRange(existing) === range) continue
+    current[name] =
+      existing === undefined ? range : assetDependencyValue(range, assetDependencyAlias(existing))
+    changed = true
+  }
+
+  pkg.assetDependencies = current
+  return changed
+}
+
 function assetDependenciesToSave(
   resolution: ResolveResult,
   rootRequests: InstallRootRequest[],

package/src/output.ts

@@ -1,7 +1,8 @@
 import type { AssetInstallMetadata, AssetSearchResult } from './contract.js'
 import type { ListInstalledAssetsResult } from './commands/list.js'
 import type { InstallResult } from './install.js'
-import type { PackedAsset } from './pack.js'
+import type { AssetDependencySync, PackedAsset } from './pack.js'
+import { assetDependencyAlias, assetDependencyRange } from './schemas.js'
 
 export function assetVersionRef(name: string, version?: string): string {
   return version ? `${name}@${version}` : name
@@ -80,18 +81,16 @@ export function installResult(
   return lines.join('\n')
 }
 
-export function listResult(
-  result: ListInstalledAssetsResult,
-  opts: { files?: boolean } = {},
-): string {
+export function listResult(result: ListInstalledAssetsResult): string {
   if (result.assets.length === 0) {
-    return 'No installed assets found.'
+    return 'No asset dependencies declared in package.json.'
   }
 
-  const lines = [`Installed assets: ${result.assets.length}`]
+  const lines = [`Asset dependencies: ${result.assets.length}`]
   for (const asset of result.assets) {
-    lines.push(assetLine(asset))
-    if (opts.files) lines.push(...assetFileLines(asset.files))
+    lines.push(`- ${assetVersionRef(asset.name, asset.range)}`)
+    const aliases = Object.entries(asset.alias).sort(([a], [b]) => a.localeCompare(b))
+    lines.push(...aliases.map(([canonical, current]) => `    ${canonical} -> ${current}`))
   }
 
   return lines.join('\n')
@@ -183,6 +182,35 @@ export function unchangedUploadResult(name: string, version: string): string {
   return `No upload needed: ${assetVersionRef(name, version)} is unchanged`
 }
 
+export function syncResult(result: AssetDependencySync): string {
+  const entries = Object.entries(result.assetDependencies)
+  if (entries.length === 0) {
+    return 'No asset dependencies declared in package.json.'
+  }
+
+  const lines = [
+    result.changed
+      ? 'Updated assetDependencies in package.json:'
+      : 'assetDependencies already up to date:',
+  ]
+  for (const [name, value] of entries.sort(([a], [b]) => a.localeCompare(b))) {
+    lines.push(`- ${assetVersionRef(name, assetDependencyRange(value))}`)
+    const aliases = Object.entries(assetDependencyAlias(value)).sort(([a], [b]) =>
+      a.localeCompare(b),
+    )
+    lines.push(...aliases.map(([canonical, current]) => `    ${canonical} -> ${current}`))
+  }
+
+  if (result.missing.length > 0) {
+    lines.push('Dependency files not found (locally modified or deleted):')
+    lines.push(...result.missing.map((file) => `- ${file.name}: ${file.path}`))
+  }
+  if (result.skipped.length > 0) {
+    lines.push(`Skipped (manifest unavailable): ${[...result.skipped].sort().join(', ')}`)
+  }
+  return lines.join('\n')
+}
+
 export function packResult(out: string, packed: PackedAsset): string {
   const lines = [`Packed: ${out}`]
   if (packed.gitignoredFiles > 0) {
@@ -226,11 +254,24 @@ function unique<T>(values: T[]): T[] {
   return [...new Set(values)]
 }
 
-function dependencyLines(label: string, deps: Record<string, string>): string[] {
+function dependencyLines(
+  label: string,
+  deps: Record<string, string | { version: string; alias?: Record<string, string> }>,
+): string[] {
   const entries = Object.entries(deps)
   if (entries.length === 0) return []
   return [
     `${label}:`,
-    ...entries.sort(([a], [b]) => a.localeCompare(b)).map(([name, value]) => `- ${name}: ${value}`),
+    ...entries
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([name, value]) => `- ${name}: ${dependencyValueLabel(value)}`),
   ]
 }
+
+function dependencyValueLabel(
+  value: string | { version: string; alias?: Record<string, string> },
+): string {
+  if (typeof value === 'string') return value
+  const aliased = Object.keys(value.alias ?? {}).length
+  return aliased > 0 ? `${value.version} (${aliased} aliased file(s))` : value.version
+}