@drawcall/market 0.1.99 → 0.2.0

package/src/resolve.ts

@@ -12,7 +12,12 @@
 import * as semver from 'semver'
 import type { MarketClient } from './client.js'
 import type { AssetExactResult } from './contract.js'
-import { semverSchema } from './schemas.js'
+import {
+  assetDependencyAlias,
+  assetDependencyRange,
+  semverSchema,
+  type AssetDependencies,
+} from './schemas.js'
 
 export interface ResolvedAsset {
   name: string
@@ -20,7 +25,7 @@ export interface ResolvedAsset {
   version: string
   description: string | null
   npmDependencies: Record<string, string>
-  assetDependencies: Record<string, string>
+  assetDependencies: AssetDependencies
   skillDependencies: Record<string, string>
 }
 
@@ -28,6 +33,12 @@ export interface ResolveResult {
   assets: ResolvedAsset[]
   npmDependencies: Record<string, string>
   skillDependencies: Record<string, string>
+  /**
+   * File aliases declared by dependents, keyed by dependency name: canonical install path → the
+   * path the dependent's project keeps the file at. Install writes files through this map (a
+   * template whose author renamed a dependency's files reinstalls them at the renamed locations).
+   */
+  assetAliases?: Record<string, Record<string, string>>
 }
 
 interface AssetRequest {
@@ -96,6 +107,7 @@ export async function resolve(
       assets,
       npmDependencies: mergeNpmDependencies(assets),
       skillDependencies: mergeSkillDependencies(assets),
+      assetAliases: mergeAssetAliases(assets),
     }
   }
 
@@ -141,7 +153,7 @@ async function resolvePass(
     const selectedVersion = exactVersion
       ? exactMetadataVersion(meta, assetName, exactVersion)
       : latestMetadataVersion(meta)
-    const assetDependencies = parseDependencies(meta.assetDependencies, assetName, 'asset')
+    const assetDependencies = parseAssetDependencies(meta.assetDependencies, assetName)
     resolved.set(assetName, {
       name: assetName,
       type: meta.type,
@@ -152,7 +164,8 @@ async function resolvePass(
       skillDependencies: parseDependencies(meta.skillDependencies, assetName, 'skill'),
     })
 
-    for (const [dependencyName, dependencyRange] of Object.entries(assetDependencies)) {
+    for (const [dependencyName, dependencyValue] of Object.entries(assetDependencies)) {
+      const dependencyRange = assetDependencyRange(dependencyValue)
       addConstraint(constraints, dependencyName, dependencyRange, `${assetName}@${selectedVersion}`)
       pending.push(dependencyName)
     }
@@ -203,6 +216,36 @@ function mergeSkillDependencies(assets: ResolvedAsset[]): Record<string, string>
   return merged
 }
 
+/**
+ * Merge file aliases from every resolved asset, keyed by the dependency they apply to. Two
+ * dependents rarely alias the same file; when they do, the first resolved asset wins — a
+ * deterministic choice that keeps installs reproducible.
+ */
+function mergeAssetAliases(assets: ResolvedAsset[]): Record<string, Record<string, string>> {
+  const merged: Record<string, Record<string, string>> = {}
+  for (const asset of assets) {
+    for (const [dependencyName, value] of Object.entries(asset.assetDependencies)) {
+      const alias = assetDependencyAlias(value)
+      if (Object.keys(alias).length === 0) continue
+      merged[dependencyName] = { ...alias, ...(merged[dependencyName] ?? {}) }
+    }
+  }
+  return merged
+}
+
+/** Like parseDependencies, but asset dependency values may also be `{ version, alias }` objects. */
+function parseAssetDependencies(value: string, assetName: string): AssetDependencies {
+  try {
+    const parsed = JSON.parse(value || '{}') as unknown
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return parsed as AssetDependencies
+    }
+  } catch {
+    // fall through to a clear error below
+  }
+  throw new ResolutionError(`Asset "${assetName}" has malformed asset dependency metadata.`)
+}
+
 function parseDependencies(
   value: string,
   assetName: string,

package/src/schemas.ts

@@ -39,7 +39,37 @@ export const assetNameSchema = z
 
 export const npmDependenciesSchema = z.record(z.string(), z.string()).default({})
 
-export const assetDependenciesSchema = z.record(z.string(), z.string()).default({})
+// An asset dependency is either a plain range ("^1.0.0") or an object carrying the range plus
+// `alias`: a map of the dependency's canonical install paths to where this project keeps the file
+// after renaming/moving it. Install writes each file at `alias[path] ?? path`; pack records the
+// aliases it detects by content hash, so renamed installed files are omitted from packs and
+// restored to their renamed locations on reinstall.
+export const assetDependencyAliasSchema = z.record(z.string(), z.string())
+
+export const assetDependencyValueSchema = z.union([
+  z.string(),
+  z.object({ version: z.string(), alias: assetDependencyAliasSchema.optional() }),
+])
+export type AssetDependencyValue = z.infer<typeof assetDependencyValueSchema>
+export type AssetDependencies = Record<string, AssetDependencyValue>
+
+export const assetDependenciesSchema = z.record(z.string(), assetDependencyValueSchema).default({})
+
+export function assetDependencyRange(value: AssetDependencyValue): string {
+  return typeof value === 'string' ? value : value.version
+}
+
+export function assetDependencyAlias(value: AssetDependencyValue): Record<string, string> {
+  return typeof value === 'string' ? {} : (value.alias ?? {})
+}
+
+/** The slimmest value expressing `range` + `alias`: a plain string when there are no aliases. */
+export function assetDependencyValue(
+  range: string,
+  alias: Record<string, string>,
+): AssetDependencyValue {
+  return Object.keys(alias).length === 0 ? range : { version: range, alias }
+}
 
 // Maps a skill label to a `skills add` source: a remote ref (owner/repo,
 // git/HTTP URL, tree/<branch>/<subpath>) or a local path to a skill directory

package/src/skill.ts

@@ -31,7 +31,9 @@ Install exact refs together in one call; names need no \`--type\`:
 
 Install prints the exact files it wrote and records the dependency so packing and later rebuilds can restore it. It never searches or generates. With no refs it installs \`assetDependencies\` from the nearest \`package.json\`. Assets may install declared skill dependencies with \`npx skills add\`. Use \`--force\` only with permission to overwrite changed local files.
 
-\`list --cwd "$PWD"\` is an offline, compact inventory from \`.drawcall/market-lock.json\`. Add \`--files\` when exact paths for previously installed assets are needed; fresh install and generation already print their paths. When selected refs are already installed, read this inventory instead of reinstalling them.
+\`list --cwd "$PWD"\` is an offline, compact inventory of the \`assetDependencies\` in the nearest \`package.json\`, including file aliases. When selected refs are already installed, read this inventory instead of reinstalling them.
+
+An \`assetDependencies\` entry is either a range string or \`{ "version": "<range>", "alias": { "<canonical path>": "<current path>" } }\`. An alias records where the project keeps a renamed installed file: install writes the file at the aliased path, and packing omits exactly that one copy (extra duplicates ship as project content). Run \`sync --cwd "$PWD"\` after renaming installed files to record aliases in \`package.json\`; template packing runs the same update automatically.
 
 ## Generate
 
@@ -47,7 +49,7 @@ Add \`--access public\` or \`--access private\` when visibility matters. Omitted
 
 ## Publish only when asked
 
-Use \`pack <source> --out <zip>\` to create a Market zip and \`upload <name> <source> "<description>" --type <type>\` to publish it. Both accept repeatable \`--npm name@range\`, \`--asset name@range\`, and \`--skill label=source\` dependencies. Template packing reads root \`assetDependencies\` and may use the API to omit unchanged installed dependency files. A skill source is \`owner/repo\`, a git URL, a full GitHub \`tree/<branch>/<subpath>\` URL, or a local skill directory inside the zip. Use the command's \`--help\` for syntax.
+Use \`pack <source> --out <zip>\` to create a Market zip and \`upload <name> <source> "<description>" --type <type>\` to publish it. Both accept repeatable \`--npm name@range\`, \`--asset name@range\`, and \`--skill label=source\` dependencies. Template packing reads root \`assetDependencies\` and may use the API to omit installed dependency files matched by content hash — even when renamed — recording renames as aliases. A skill source is \`owner/repo\`, a git URL, a full GitHub \`tree/<branch>/<subpath>\` URL, or a local skill directory inside the zip. Use the command's \`--help\` for syntax.
 
 Use \`--unapproved\` only when explicitly requested. Do not install an unapproved asset without acceptance. If login is required, ask before running \`npx @drawcall/market login\`.
 `

package/src/v1/client.ts

@@ -0,0 +1,28 @@
+import { createORPCClient } from '@orpc/client'
+import { OpenAPILink } from '@orpc/openapi-client/fetch'
+import type { ContractRouterClient } from '@orpc/contract'
+import { contract, type V1Contract } from './contract.js'
+
+export type MarketV1Client = ContractRouterClient<V1Contract>
+
+const DEFAULT_BASE_URL = 'https://market.drawcall.ai'
+
+export interface MarketV1ClientOptions {
+  baseUrl?: string
+  fetch?: typeof globalThis.fetch
+  authToken?: string
+}
+
+/**
+ * A typed client for the v1 REST surface (`/api/v1`). Same call shapes as the legacy RPC client —
+ * `client.asset.exact({ name })` — but speaking plain HTTP: reads are GETs on resource URLs, so
+ * they are curl-able, shareable and cacheable.
+ */
+export function createClient(opts: MarketV1ClientOptions = {}): MarketV1Client {
+  const link = new OpenAPILink(contract, {
+    url: new URL('/api/v1', opts.baseUrl ?? DEFAULT_BASE_URL).href,
+    fetch: opts.fetch,
+    headers: opts.authToken ? { authorization: `Bearer ${opts.authToken}` } : undefined,
+  })
+  return createORPCClient<MarketV1Client>(link)
+}

package/src/v1/contract.ts

@@ -0,0 +1,140 @@
+import { oc } from '@orpc/contract'
+import { z } from 'zod'
+import type { AssetFileManifest } from '../schemas.js'
+import type {
+  AssetExactResult,
+  AssetFileEntry,
+  AssetInstallMetadata,
+  AssetSearchResult,
+  AssetVersion,
+  PaginatedList,
+  User,
+} from '../contract.js'
+import {
+  MAX_UPLOAD_ZIP_SIZE_BYTES,
+  agentRunStatusSchema,
+  agentStartSchema,
+  agentStatusSchema,
+  assetFilesSchema,
+  exactAssetSchema,
+  fileManifestSchema,
+  generateAssetSchema,
+  generateJobStatusSchema,
+  generateResponseSchema,
+  generateStatusInputSchema,
+  listAssetsSchema,
+  updateProfileSchema,
+  uploadZipSchema,
+} from '../schemas.js'
+
+/**
+ * The v1 manifest of an asset version — the one linkable, cacheable answer to "what is this
+ * version": its metadata plus every stored file with a fetch-ready content-plane URL, the preview
+ * URL, and the zip URL. All URLs are minted by the server and MUST be treated as opaque by
+ * clients; that opacity is what lets the content plane evolve without client releases.
+ */
+export interface AssetVersionManifest {
+  name: string
+  type: string
+  version: string
+  description: string | null
+  approved: boolean
+  access: 'public' | 'private'
+  npmDependencies: string
+  assetDependencies: string
+  skillDependencies: string
+  files: AssetFileEntry[]
+  previewUrl: string | null
+  zipUrl: string
+}
+
+/**
+ * The v1 contract: the same procedure tree as the legacy RPC surface (so call sites migrate by
+ * swapping only the client), with HTTP routes attached — served as plain REST under `/api/v1`.
+ * The route annotations here ARE the control-plane URL contract.
+ */
+export const contract = {
+  asset: {
+    search: oc
+      .route({ method: 'GET', path: '/assets' })
+      .input(listAssetsSchema)
+      .output(z.custom<PaginatedList<AssetSearchResult>>()),
+
+    exact: oc
+      .route({ method: 'GET', path: '/assets/{name}' })
+      .input(exactAssetSchema)
+      .output(z.custom<AssetExactResult | null>()),
+
+    // The manifest is new in v1 — it merges the legacy `files` + metadata into one GET.
+    manifest: oc
+      .route({ method: 'GET', path: '/assets/{name}/{version}' })
+      .input(assetFilesSchema)
+      .output(z.custom<AssetVersionManifest>()),
+
+    files: oc
+      .route({ method: 'GET', path: '/assets/{name}/{version}/files' })
+      .input(assetFilesSchema)
+      .output(z.custom<{ files: AssetFileEntry[] }>()),
+
+    fileManifest: oc
+      .route({ method: 'GET', path: '/assets/{name}/{version}/file-manifest' })
+      .input(fileManifestSchema)
+      .output(z.custom<AssetFileManifest>()),
+
+    uploadZip: oc
+      .route({ method: 'PUT', path: '/assets/{name}/{version}' })
+      .input(
+        uploadZipSchema
+          .extend({ zip: z.instanceof(File) })
+          .refine((input) => input.zip.size < MAX_UPLOAD_ZIP_SIZE_BYTES, {
+            message: 'Upload zip must be smaller than 1 GB',
+            path: ['zip'],
+          }),
+      )
+      .output(z.custom<AssetVersion>()),
+
+    installMetadata: oc
+      .route({ method: 'GET', path: '/types' })
+      .output(z.custom<Record<string, AssetInstallMetadata>>()),
+
+    generate: oc
+      .route({ method: 'POST', path: '/generations' })
+      .input(generateAssetSchema)
+      .output(generateResponseSchema),
+
+    generateStatus: oc
+      .route({ method: 'GET', path: '/generations/{jobId}' })
+      .input(generateStatusInputSchema)
+      .output(generateJobStatusSchema),
+
+    agent: {
+      start: oc
+        .route({ method: 'POST', path: '/agent-runs' })
+        .input(agentStartSchema)
+        .output(z.object({ runId: z.string() })),
+      status: oc
+        .route({ method: 'GET', path: '/agent-runs/{runId}' })
+        .input(agentStatusSchema)
+        .output(agentRunStatusSchema),
+    },
+  },
+
+  user: {
+    getProfile: oc.route({ method: 'GET', path: '/me' }).output(z.custom<User | null>()),
+
+    updateProfile: oc
+      .route({ method: 'PATCH', path: '/me' })
+      .input(updateProfileSchema)
+      .output(z.custom<User>()),
+
+    getAuthToken: oc
+      .route({ method: 'GET', path: '/me/auth-token' })
+      .output(z.custom<{ prefix: string; createdAt: Date } | null>()),
+
+    createAuthToken: oc
+      .route({ method: 'POST', path: '/me/auth-token' })
+      .output(z.object({ token: z.string(), prefix: z.string() })),
+  },
+}
+
+export type V1Contract = typeof contract

package/src/v1/index.ts

@@ -0,0 +1,2 @@
+export { contract, type V1Contract, type AssetVersionManifest } from './contract.js'
+export { createClient, type MarketV1Client, type MarketV1ClientOptions } from './client.js'

package/dist/market-lock.d.ts

@@ -1,16 +0,0 @@
-export declare const MARKET_LOCK_PATH = ".drawcall/market-lock.json";
-export interface MarketLockAsset {
-    version: string;
-    type: string;
-    /** Install paths of the asset's files. Content hashes now live on the server (`asset.fileManifest`). */
-    files: string[];
-}
-export interface MarketLock {
-    version: 1;
-    assets: Record<string, MarketLockAsset>;
-}
-export declare function readMarketLock(projectRoot: string): Promise<MarketLock>;
-export declare function writeMarketLock(projectRoot: string, lock: MarketLock): Promise<void>;
-export declare function emptyMarketLock(): MarketLock;
-export declare function sha256(bytes: Uint8Array): string;
-//# sourceMappingURL=market-lock.d.ts.map

package/dist/market-lock.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"market-lock.d.ts","sourceRoot":"","sources":["../src/market-lock.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB,+BAA+B,CAAA;AAE5D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,wGAAwG;IACxG,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAA;IACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CACxC;AAqBD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ7E;AAED,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1F;AAED,wBAAgB,eAAe,IAAI,UAAU,CAK5C;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEhD"}

package/dist/market-lock.js

@@ -1,48 +0,0 @@
-import { createHash } from 'crypto';
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { z } from 'zod';
-export const MARKET_LOCK_PATH = '.drawcall/market-lock.json';
-// Content hashes moved to the server, so the lock records only install paths. It still reads the
-// legacy `{ path: { sha256 } }` shape and normalizes it to a path list, so an existing lock keeps
-// working and is rewritten to the slim form on the next install.
-const filesSchema = z
-    .union([z.array(z.string()), z.record(z.string(), z.object({ sha256: z.string() }))])
-    .transform((files) => (Array.isArray(files) ? files : Object.keys(files)));
-const marketLockSchema = z.object({
-    version: z.literal(1),
-    assets: z.record(z.string(), z.object({
-        version: z.string(),
-        type: z.string(),
-        files: filesSchema,
-    })),
-});
-export async function readMarketLock(projectRoot) {
-    const lockPath = path.join(projectRoot, MARKET_LOCK_PATH);
-    try {
-        return marketLockSchema.parse(JSON.parse(await fs.readFile(lockPath, 'utf-8')));
-    }
-    catch (error) {
-        if (isMissingFile(error))
-            return emptyMarketLock();
-        throw error;
-    }
-}
-export async function writeMarketLock(projectRoot, lock) {
-    const lockPath = path.join(projectRoot, MARKET_LOCK_PATH);
-    await fs.mkdir(path.dirname(lockPath), { recursive: true });
-    await fs.writeFile(lockPath, JSON.stringify(lock, null, 2) + '\n');
-}
-export function emptyMarketLock() {
-    return {
-        version: 1,
-        assets: {},
-    };
-}
-export function sha256(bytes) {
-    return createHash('sha256').update(bytes).digest('hex');
-}
-function isMissingFile(error) {
-    return error instanceof Error && 'code' in error && error.code === 'ENOENT';
-}
-//# sourceMappingURL=market-lock.js.map

package/dist/market-lock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"market-lock.js","sourceRoot":"","sources":["../src/market-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAc5D,iGAAiG;AACjG,kGAAkG;AAClG,iEAAiE;AACjE,MAAM,WAAW,GAAG,CAAC;KAClB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;KACpF,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAE5E,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CACd,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,WAAW;KACnB,CAAC,CACH;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAA;IACzD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,eAAe,EAAE,CAAA;QAClD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,IAAgB;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAA;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAiB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAA;AAC7E,CAAC"}

package/src/market-lock.ts

@@ -1,68 +0,0 @@
-import { createHash } from 'crypto'
-import * as fs from 'fs/promises'
-import * as path from 'path'
-import { z } from 'zod'
-
-export const MARKET_LOCK_PATH = '.drawcall/market-lock.json'
-
-export interface MarketLockAsset {
-  version: string
-  type: string
-  /** Install paths of the asset's files. Content hashes now live on the server (`asset.fileManifest`). */
-  files: string[]
-}
-
-export interface MarketLock {
-  version: 1
-  assets: Record<string, MarketLockAsset>
-}
-
-// Content hashes moved to the server, so the lock records only install paths. It still reads the
-// legacy `{ path: { sha256 } }` shape and normalizes it to a path list, so an existing lock keeps
-// working and is rewritten to the slim form on the next install.
-const filesSchema = z
-  .union([z.array(z.string()), z.record(z.string(), z.object({ sha256: z.string() }))])
-  .transform((files) => (Array.isArray(files) ? files : Object.keys(files)))
-
-const marketLockSchema = z.object({
-  version: z.literal(1),
-  assets: z.record(
-    z.string(),
-    z.object({
-      version: z.string(),
-      type: z.string(),
-      files: filesSchema,
-    }),
-  ),
-})
-
-export async function readMarketLock(projectRoot: string): Promise<MarketLock> {
-  const lockPath = path.join(projectRoot, MARKET_LOCK_PATH)
-  try {
-    return marketLockSchema.parse(JSON.parse(await fs.readFile(lockPath, 'utf-8')))
-  } catch (error) {
-    if (isMissingFile(error)) return emptyMarketLock()
-    throw error
-  }
-}
-
-export async function writeMarketLock(projectRoot: string, lock: MarketLock): Promise<void> {
-  const lockPath = path.join(projectRoot, MARKET_LOCK_PATH)
-  await fs.mkdir(path.dirname(lockPath), { recursive: true })
-  await fs.writeFile(lockPath, JSON.stringify(lock, null, 2) + '\n')
-}
-
-export function emptyMarketLock(): MarketLock {
-  return {
-    version: 1,
-    assets: {},
-  }
-}
-
-export function sha256(bytes: Uint8Array): string {
-  return createHash('sha256').update(bytes).digest('hex')
-}
-
-function isMissingFile(error: unknown): boolean {
-  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
-}