@drawcall/market 0.1.99 → 0.2.0

package/skills/market/SKILL.md

@@ -31,7 +31,9 @@ Install exact refs together in one call; names need no `--type`:
 
 Install prints the exact files it wrote and records the dependency so packing and later rebuilds can restore it. It never searches or generates. With no refs it installs `assetDependencies` from the nearest `package.json`. Assets may install declared skill dependencies with `npx skills add`. Use `--force` only with permission to overwrite changed local files.
 
-`list --cwd "$PWD"` is an offline, compact inventory from `.drawcall/market-lock.json`. Add `--files` when exact paths for previously installed assets are needed; fresh install and generation already print their paths. When selected refs are already installed, read this inventory instead of reinstalling them.
+`list --cwd "$PWD"` is an offline, compact inventory of the `assetDependencies` in the nearest `package.json`, including file aliases. When selected refs are already installed, read this inventory instead of reinstalling them.
+
+An `assetDependencies` entry is either a range string or `{ "version": "<range>", "alias": { "<canonical path>": "<current path>" } }`. An alias records where the project keeps a renamed installed file: install writes the file at the aliased path, and packing omits exactly that one copy (extra duplicates ship as project content). Run `sync --cwd "$PWD"` after renaming installed files to record aliases in `package.json`; template packing runs the same update automatically.
 
 ## Generate
 
@@ -47,6 +49,6 @@ Add `--access public` or `--access private` when visibility matters. Omitted acc
 
 ## Publish only when asked
 
-Use `pack <source> --out <zip>` to create a Market zip and `upload <name> <source> "<description>" --type <type>` to publish it. Both accept repeatable `--npm name@range`, `--asset name@range`, and `--skill label=source` dependencies. Template packing reads root `assetDependencies` and may use the API to omit unchanged installed dependency files. A skill source is `owner/repo`, a git URL, a full GitHub `tree/<branch>/<subpath>` URL, or a local skill directory inside the zip. Use the command's `--help` for syntax.
+Use `pack <source> --out <zip>` to create a Market zip and `upload <name> <source> "<description>" --type <type>` to publish it. Both accept repeatable `--npm name@range`, `--asset name@range`, and `--skill label=source` dependencies. Template packing reads root `assetDependencies` and may use the API to omit installed dependency files matched by content hash — even when renamed — recording renames as aliases. A skill source is `owner/repo`, a git URL, a full GitHub `tree/<branch>/<subpath>` URL, or a local skill directory inside the zip. Use the command's `--help` for syntax.
 
 Use `--unapproved` only when explicitly requested. Do not install an unapproved asset without acceptance. If login is required, ask before running `npx @drawcall/market login`.

package/src/asset-implementation.ts

@@ -6,7 +6,7 @@ import type {
   GenerateAssetResult,
   PaginatedList,
 } from './contract.js'
-import type { AssetAccess, AssetType, GenerateJobStatus } from './schemas.js'
+import type { AssetAccess, AssetDependencies, AssetType, GenerateJobStatus } from './schemas.js'
 
 export const ASSET_RELEVANCE_SCORE: unique symbol = Symbol('assetRelevanceScore')
 
@@ -38,7 +38,7 @@ export interface AssetUploadZipInput {
   version: string
   description?: string
   npmDependencies: Record<string, string>
-  assetDependencies: Record<string, string>
+  assetDependencies: AssetDependencies
   skillDependencies: Record<string, string>
   tags: string[]
   zip: File

package/src/cli.ts

@@ -13,6 +13,7 @@ import { generateCommand } from './commands/generate.js'
 import { generateInstallCommand } from './commands/generate-install.js'
 import { listCommand } from './commands/list.js'
 import { packCommand } from './commands/pack.js'
+import { syncCommand } from './commands/sync.js'
 import { previewCommand } from './commands/preview.js'
 import { uploadCommand } from './commands/upload.js'
 import { typesCommand } from './commands/types.js'
@@ -125,13 +126,25 @@ program
 
 program
   .command('list')
-  .description('List locally installed assets')
-  .option('--files', 'Include installed file paths', false)
+  .description('List asset dependencies declared in package.json, including file aliases')
   .option('--cwd <dir>', 'Project directory')
-  .action(async (opts: { cwd?: string; files: boolean }) => {
+  .action(async (opts: { cwd?: string }) => {
     await listCommand({
       cwd: opts.cwd,
-      files: opts.files,
+    })
+  })
+
+program
+  .command('sync')
+  .description(
+    'Update package.json assetDependencies aliases to match where installed files live now',
+  )
+  .addOption(apiOption)
+  .option('--cwd <dir>', 'Project directory')
+  .action(async (opts: { api?: string; cwd?: string }) => {
+    await syncCommand({
+      baseUrl: opts.api,
+      cwd: opts.cwd,
     })
   })
 
@@ -176,6 +189,7 @@ program
   .addOption(apiOption)
   .option('--unapproved', 'Include unapproved versions', false)
   .option('--limit <n>', 'Max results, 1-5', parseSearchLimit, 5)
+  .option('--json', 'Emit a machine-readable JSON array instead of the summary lines', false)
   .action(
     async (
       query: string,
@@ -184,6 +198,7 @@ program
         api?: string
         unapproved: boolean
         limit: number
+        json: boolean
       },
     ) => {
       requireType(opts.type, 'Search')
@@ -192,6 +207,7 @@ program
         baseUrl: opts.api,
         unapproved: opts.unapproved,
         limit: opts.limit,
+        json: opts.json,
       })
     },
   )

package/src/commands/install.ts

@@ -4,7 +4,7 @@ import ora from 'ora'
 import { resolve } from '../resolve.js'
 import { findInstallRoot, install as runInstall, type InstallRootRequest } from '../install.js'
 import { packageJsonAssetDependencies } from '../package-json.js'
-import { assetNameSchema } from '../schemas.js'
+import { assetDependencyRange, assetNameSchema, type AssetDependencies } from '../schemas.js'
 import { getCliClient } from '../cli-client.js'
 import { installResult } from '../output.js'
 import type { MarketClient } from '../client.js'
@@ -125,12 +125,15 @@ async function packageJsonRequests(cwd: string | undefined): Promise<AssetReques
   const installRoot = await findInstallRoot(cwd ?? process.cwd())
   const pkgPath = path.join(installRoot, 'package.json')
   const dependencies = await readPackageJsonAssetDependencies(pkgPath)
-  const requests = Object.entries(dependencies).map(([name, range]) => ({
-    name,
-    range,
-    saveRange: range,
-    save: false,
-  }))
+  const requests = Object.entries(dependencies).map(([name, value]) => {
+    const range = assetDependencyRange(value)
+    return {
+      name,
+      range,
+      saveRange: range,
+      save: false,
+    }
+  })
 
   if (requests.length === 0) {
     throw new Error(
@@ -141,7 +144,7 @@ async function packageJsonRequests(cwd: string | undefined): Promise<AssetReques
   return requests
 }
 
-async function readPackageJsonAssetDependencies(pkgPath: string): Promise<Record<string, string>> {
+async function readPackageJsonAssetDependencies(pkgPath: string): Promise<AssetDependencies> {
   try {
     return packageJsonAssetDependencies(await fs.readFile(pkgPath, 'utf-8'), pkgPath)
   } catch (error) {

package/src/commands/list.ts

@@ -1,48 +1,62 @@
+import * as fs from 'fs/promises'
 import * as path from 'path'
 import { findInstallRoot } from '../install.js'
-import { MARKET_LOCK_PATH, readMarketLock } from '../market-lock.js'
+import { packageJsonAssetDependencies } from '../package-json.js'
+import { assetDependencyAlias, assetDependencyRange } from '../schemas.js'
 import { listResult } from '../output.js'
 
 export interface ListCommandOptions {
   cwd?: string
-  files?: boolean
 }
 
 export interface InstalledAssetListing {
   name: string
-  version: string
-  type: string
-  files: string[]
+  range: string
+  /** Canonical install path → the project's current path, for files renamed after install. */
+  alias: Record<string, string>
 }
 
 export interface ListInstalledAssetsResult {
   projectRoot: string
-  lockPath: string
+  packageJsonPath: string
   assets: InstalledAssetListing[]
 }
 
 export async function listCommand(opts: ListCommandOptions): Promise<void> {
   const result = await listInstalledAssets(opts.cwd)
-  console.log(listResult(result, { files: opts.files }))
+  console.log(listResult(result))
 }
 
+/** The project's declared asset dependencies — package.json is the single source of truth. */
 export async function listInstalledAssets(
   cwd: string | undefined,
 ): Promise<ListInstalledAssetsResult> {
   const projectRoot = await findInstallRoot(cwd ?? process.cwd())
-  const lock = await readMarketLock(projectRoot)
-  const assets = Object.entries(lock.assets)
-    .map(([name, asset]) => ({
+  const packageJsonPath = path.join(projectRoot, 'package.json')
+  const dependencies = await readAssetDependencies(packageJsonPath)
+  const assets = Object.entries(dependencies)
+    .map(([name, value]) => ({
       name,
-      version: asset.version,
-      type: asset.type,
-      files: [...asset.files].sort((a, b) => a.localeCompare(b)),
+      range: assetDependencyRange(value),
+      alias: assetDependencyAlias(value),
     }))
     .sort((a, b) => a.name.localeCompare(b.name))
 
   return {
     projectRoot,
-    lockPath: path.join(projectRoot, MARKET_LOCK_PATH),
+    packageJsonPath,
     assets,
   }
 }
+
+async function readAssetDependencies(packageJsonPath: string) {
+  try {
+    return packageJsonAssetDependencies(
+      await fs.readFile(packageJsonPath, 'utf-8'),
+      packageJsonPath,
+    )
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return {}
+    throw error
+  }
+}

package/src/commands/pack.ts

@@ -2,7 +2,12 @@ import * as fs from 'fs/promises'
 import * as path from 'path'
 import ora from 'ora'
 import { getCliClient } from '../cli-client.js'
-import { packAsset, packPolicyForType, parsePackDependencies } from '../pack.js'
+import {
+  fileManifestForRange,
+  packAsset,
+  packPolicyForType,
+  parsePackDependencies,
+} from '../pack.js'
 import { packResult } from '../output.js'
 import type { AssetType } from '../schemas.js'
 
@@ -39,7 +44,7 @@ export async function packCommand(zipFilter: string, opts: PackCommandOptions):
         skill: opts.skill,
       }),
       policy: packPolicyForType(opts.type),
-      fetchFileManifest: (name, version) => client.asset.fileManifest({ name, version }),
+      fetchFileManifest: fileManifestForRange(client.asset),
     })
     const out = opts.out ? path.resolve(cwd, opts.out) : defaultPackPath(packed.sourcePath)
 

package/src/commands/search.ts

@@ -10,6 +10,8 @@ export interface SearchCommandOptions {
   unapproved?: boolean
   baseUrl?: string
   limit?: number
+  /** Emit a machine-readable JSON array instead of the human-readable lines. */
+  json?: boolean
 }
 
 export async function searchCommand(query: string, opts: SearchCommandOptions): Promise<void> {
@@ -17,8 +19,8 @@ export async function searchCommand(query: string, opts: SearchCommandOptions):
 
   const spinner = ora({
     text: `Searching "${query}"`,
-    isEnabled: Boolean(process.stderr.isTTY),
-    isSilent: !process.stderr.isTTY,
+    isEnabled: Boolean(process.stderr.isTTY) && !opts.json,
+    isSilent: !process.stderr.isTTY || Boolean(opts.json),
   }).start()
   const results = await client.asset
     .search({
@@ -31,6 +33,23 @@ export async function searchCommand(query: string, opts: SearchCommandOptions):
     })
     .finally(() => spinner.stop())
 
+  if (opts.json) {
+    // Stable machine-readable shape for scripts; the human-readable lines below may change freely.
+    console.log(
+      JSON.stringify(
+        results.items.map((item) => ({
+          name: item.name,
+          version: item.latestVersion,
+          type: item.type,
+          approved: item.approved,
+          access: item.access,
+          description: item.description,
+        })),
+      ),
+    )
+    return
+  }
+
   console.log(
     searchSummary({
       query,

package/src/commands/sync.ts

@@ -0,0 +1,30 @@
+import ora from 'ora'
+import { getCliClient } from '../cli-client.js'
+import { fileManifestForRange, syncAssetDependencies } from '../pack.js'
+import { syncResult } from '../output.js'
+
+export interface SyncCommandOptions {
+  cwd?: string
+  baseUrl?: string
+}
+
+export async function syncCommand(opts: SyncCommandOptions): Promise<void> {
+  const spinner = ora({
+    text: 'Syncing assetDependencies',
+    isEnabled: Boolean(process.stderr.isTTY),
+    isSilent: !process.stderr.isTTY,
+  }).start()
+
+  try {
+    const { client } = await getCliClient({ baseUrl: opts.baseUrl })
+    const result = await syncAssetDependencies(
+      opts.cwd ?? process.cwd(),
+      fileManifestForRange(client.asset),
+    )
+    spinner.stop()
+    console.log(syncResult(result))
+  } catch (err) {
+    spinner.stop()
+    throw err
+  }
+}

package/src/commands/upload.ts

@@ -2,7 +2,12 @@ import ora from 'ora'
 import semver from 'semver'
 import { downloadAssetZipBytes } from '../client.js'
 import { getCliClient } from '../cli-client.js'
-import { packAsset, packPolicyFromInstallMetadata, parsePackDependencies } from '../pack.js'
+import {
+  fileManifestForRange,
+  packAsset,
+  packPolicyFromInstallMetadata,
+  parsePackDependencies,
+} from '../pack.js'
 import { unchangedUploadResult, uploadResult } from '../output.js'
 import {
   assetDescriptionSchema,
@@ -61,7 +66,7 @@ export async function uploadCommand(
       cwd,
       dependencies,
       policy: packPolicyFromInstallMetadata(installMetadata[type]),
-      fetchFileManifest: (name, version) => client.asset.fileManifest({ name, version }),
+      fetchFileManifest: fileManifestForRange(client.asset),
     })
     const { zip, npmDependencies, assetDependencies, skillDependencies } = packed
     const profile = await client.user.getProfile()
@@ -133,16 +138,21 @@ export function parseUploadDescription(description: string): string {
   }
 }
 
-/** Compare a stored dependency JSON string against a freshly parsed record. */
-function depsEqual(storedJson: string, next: Record<string, string>): boolean {
-  let stored: Record<string, string>
+/** Compare a stored dependency JSON string against a freshly parsed record. Values may be nested
+ *  (asset dependencies carry `{ version, alias }`), so equality is structural with sorted keys. */
+function depsEqual(storedJson: string, next: Record<string, unknown>): boolean {
   try {
-    stored = JSON.parse(storedJson || '{}') as Record<string, string>
+    return stableJson(JSON.parse(storedJson || '{}')) === stableJson(next)
   } catch {
     return false
   }
-  const keys = Object.keys(stored)
-  return keys.length === Object.keys(next).length && keys.every((key) => stored[key] === next[key])
+}
+
+function stableJson(value: unknown): string {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return JSON.stringify(value)
+  const record = value as Record<string, unknown>
+  const keys = Object.keys(record).sort()
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(',')}}`
 }
 
 function nextVersion(latest?: string): string {

package/src/index.ts

@@ -1,3 +1,7 @@
+// The v1 REST surface (`/api/v1`): routed contract + typed client. Prefer this; the legacy RPC
+// client below is deprecated and retires together with `/api/rpc`.
+export * as v1 from './v1/index.js'
+
 // Client
 export { createMarketClient, downloadAssetZipBytes } from './client.js'
 export type { MarketClient, MarketClientOptions } from './client.js'
@@ -62,6 +66,11 @@ export {
   assetAccessSchema,
   npmDependenciesSchema,
   assetDependenciesSchema,
+  assetDependencyAliasSchema,
+  assetDependencyValueSchema,
+  assetDependencyRange,
+  assetDependencyAlias,
+  assetDependencyValue,
   skillDependenciesSchema,
   uploadZipSchema,
   exactAssetSchema,
@@ -82,6 +91,8 @@ export {
 export type {
   AssetType,
   AssetAccess,
+  AssetDependencies,
+  AssetDependencyValue,
   AssetFileManifest,
   AgentResultAsset,
   AgentResult,

package/src/install.ts

@@ -18,9 +18,9 @@ import { detectPackageManager, installDependencies } from 'nypm'
 import type { MarketClient } from './client.js'
 import type { AssetFilesResult, AssetInstallMetadata } from './contract.js'
 import { withProjectInstallLock } from './install-lock.js'
-import { readMarketLock, writeMarketLock } from './market-lock.js'
-import { parsePackageJson, type PackageJson } from './package-json.js'
+import { packageJsonAssetDependencies, parsePackageJson, type PackageJson } from './package-json.js'
 import type { ResolveResult } from './resolve.js'
+import { assetDependencyAlias, assetDependencyRange, assetDependencyValue } from './schemas.js'
 
 export interface InstallOptions {
   /** Directory to start project root discovery from (default: cwd) */
@@ -78,6 +78,8 @@ interface DownloadOptions {
   force: boolean
   log: (message: string) => void
   key?: string
+  /** File aliases per asset name: canonical install path → the project's current path for it. */
+  aliases: Record<string, Record<string, string>>
 }
 
 export async function install(
@@ -89,15 +91,16 @@ export async function install(
   const installRoot = await findInstallRoot(opts.cwd ?? process.cwd())
   const metadata = opts.installMetadata ?? {}
 
+  const aliases = await projectAssetAliases(installRoot, resolution)
   const download = await downloadAssets(client, resolution, installRoot, {
     force: opts.force ?? false,
     log,
     key: opts.key,
+    aliases,
   })
   const integration = await withProjectInstallLock(
     installRoot,
     async () => {
-      await writeInstalledAssetLock(installRoot, download.assets)
       const packageJsonUpdate = await updatePackageJson(resolution, installRoot, {
         rootRequests: opts.rootRequests ?? [],
         installMetadata: metadata,
@@ -186,21 +189,16 @@ async function downloadOneAsset(
   // Only the network fetches are retried — downloads are the sole transient step; file writes are
   // deterministic local work and a failure there is a real error, not worth re-attempting.
   const files = await fetchAssetEntries(client, asset, opts)
+  const alias = opts.aliases[asset.name] ?? {}
   const installedFiles: string[] = []
   const warnings: string[] = []
   let wrotePackageJson = false
 
   for (const [relativePath, content] of files) {
-    const zipPath = relativePath.replace(/\\/g, '/')
-    if (
-      zipPath.split('/').includes('..') ||
-      path.posix.isAbsolute(zipPath) ||
-      path.win32.isAbsolute(zipPath)
-    ) {
-      throw new Error(`Zip contains an unsafe path: ${relativePath}`)
-    }
-
-    const normalizedPath = path.posix.normalize(zipPath)
+    const normalizedPath = safeRelativePath(
+      relativePath,
+      () => `Zip contains an unsafe path: ${relativePath}`,
+    )
     if (
       normalizedPath === '.' ||
       (normalizedPath === 'README.md' && asset.type !== 'template') ||
@@ -209,11 +207,22 @@ async function downloadOneAsset(
       continue
     }
 
-    const filePath = path.join(projectRoot, normalizedPath)
+    // An alias redirects the file to where this project keeps it (a rename recorded by pack or a
+    // dependent asset). Alias targets come from metadata, so they pass the same traversal guard.
+    const aliased = alias[normalizedPath]
+    const targetPath =
+      aliased === undefined
+        ? normalizedPath
+        : safeRelativePath(
+            aliased,
+            () => `Alias for ${normalizedPath} in ${asset.name} is an unsafe path: ${aliased}`,
+          )
+
+    const filePath = path.join(projectRoot, targetPath)
     const existing = await maybeReadFile(filePath)
     if (existing && !bytesEqual(existing, content) && !opts.force) {
       warnings.push(
-        `Skipped ${normalizedPath} from ${asset.name}@${asset.version}; file already exists. Re-run with --force to overwrite.`,
+        `Skipped ${targetPath} from ${asset.name}@${asset.version}; file already exists. Re-run with --force to overwrite.`,
       )
       continue
     }
@@ -221,12 +230,12 @@ async function downloadOneAsset(
     if (!existing || !bytesEqual(existing, content)) {
       await fs.mkdir(path.dirname(filePath), { recursive: true })
       await fs.writeFile(filePath, content)
-      if (normalizedPath === 'package.json') {
+      if (targetPath === 'package.json') {
         wrotePackageJson = true
       }
     }
 
-    installedFiles.push(normalizedPath)
+    installedFiles.push(targetPath)
   }
 
   opts.log(`Downloaded ${installedFiles.length} files from ${asset.name}@${asset.version}.`)
@@ -243,6 +252,46 @@ async function downloadOneAsset(
   }
 }
 
+/** Validate + normalize a posix-relative install path; throws `message()` on traversal/absolute. */
+function safeRelativePath(candidate: string, message: () => string): string {
+  const posixPath = candidate.replace(/\\/g, '/')
+  if (
+    posixPath.split('/').includes('..') ||
+    path.posix.isAbsolute(posixPath) ||
+    path.win32.isAbsolute(posixPath)
+  ) {
+    throw new Error(message())
+  }
+  return path.posix.normalize(posixPath)
+}
+
+/**
+ * File aliases per asset, merged from the project's own package.json `assetDependencies` and the
+ * aliases dependents declared in their metadata. The project's entries win: the user's local
+ * layout beats what a template recorded at publish time.
+ */
+async function projectAssetAliases(
+  projectRoot: string,
+  resolution: ResolveResult,
+): Promise<Record<string, Record<string, string>>> {
+  const merged: Record<string, Record<string, string>> = {}
+  for (const [name, alias] of Object.entries(resolution.assetAliases ?? {})) {
+    merged[name] = { ...alias }
+  }
+
+  const pkgPath = path.join(projectRoot, 'package.json')
+  const pkgJson = await maybeReadFile(pkgPath)
+  if (!pkgJson) return merged
+
+  const declared = packageJsonAssetDependencies(new TextDecoder().decode(pkgJson), pkgPath)
+  for (const [name, value] of Object.entries(declared)) {
+    const alias = assetDependencyAlias(value)
+    if (Object.keys(alias).length === 0) continue
+    merged[name] = { ...(merged[name] ?? {}), ...alias }
+  }
+  return merged
+}
+
 /** Files fetched in flight per asset. Assets themselves download 8-wide, so this bounds total
  *  connections at 8×4 against edge-cached objects — cheap for the CDN, fast for the install. */
 const FILE_DOWNLOAD_CONCURRENCY = 4
@@ -396,7 +445,7 @@ async function updatePackageJson(
     opts.rootRequests,
     opts.installMetadata,
   )
-  if (mergeRecord(pkg, 'assetDependencies', assetDependencies)) {
+  if (mergeAssetDependencyRanges(pkg, assetDependencies)) {
     changed = true
   }
 
@@ -417,28 +466,13 @@ async function runPackageManagerInstall(projectRoot: string, log: (msg: string)
   log('npm dependencies installed.')
 }
 
-async function writeInstalledAssetLock(
-  projectRoot: string,
-  assets: InstalledAsset[],
-): Promise<void> {
-  const lock = await readMarketLock(projectRoot)
-  for (const asset of assets) {
-    lock.assets[asset.name] = {
-      version: asset.version,
-      type: asset.type,
-      files: asset.files,
-    }
-  }
-  await writeMarketLock(projectRoot, lock)
-}
-
 function defaultPackageJson(): PackageJson {
   return { name: 'my-project', private: true, dependencies: {} }
 }
 
 function mergeRecord(
   pkg: PackageJson,
-  field: 'dependencies' | 'assetDependencies',
+  field: 'dependencies',
   values: Record<string, string>,
 ): boolean {
   const entries = Object.entries(values)
@@ -448,7 +482,7 @@ function mergeRecord(
   let changed = false
 
   for (const [name, range] of entries) {
-    if (field === 'dependencies' && name.startsWith('@drawcall/') && current[name] === 'latest') {
+    if (name.startsWith('@drawcall/') && current[name] === 'latest') {
       continue
     }
     if (current[name] === range) continue
@@ -460,6 +494,26 @@ function mergeRecord(
   return changed
 }
 
+/** Merge saved ranges into `assetDependencies`, preserving any aliases an entry already carries. */
+function mergeAssetDependencyRanges(pkg: PackageJson, values: Record<string, string>): boolean {
+  const entries = Object.entries(values)
+  if (entries.length === 0) return false
+
+  const current = pkg.assetDependencies ?? {}
+  let changed = false
+
+  for (const [name, range] of entries) {
+    const existing = current[name]
+    if (existing !== undefined && assetDependencyRange(existing) === range) continue
+    current[name] =
+      existing === undefined ? range : assetDependencyValue(range, assetDependencyAlias(existing))
+    changed = true
+  }
+
+  pkg.assetDependencies = current
+  return changed
+}
+
 function assetDependenciesToSave(
   resolution: ResolveResult,
   rootRequests: InstallRootRequest[],