@drawcall/market 0.2.3 → 0.4.0

package/dist/v1/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/v1/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAWvB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAA;AAuBtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,KAAK,EAAE;QACL,MAAM,EAAE,EAAE;aACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aACzC,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAoC,CAAC;QAEvD,KAAK,EAAE,EAAE;aACN,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aAChD,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAA2B,CAAC;QAE9C,oFAAoF;QACpF,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;aAC1D,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAwB,CAAC;QAE3C,KAAK,EAAE,EAAE;aACN,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;aAChE,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAA+B,CAAC;QAElD,YAAY,EAAE,EAAE;aACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC;aACxE,KAAK,CAAC,kBAAkB,CAAC;aACzB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAqB,CAAC;QAExC,SAAS,EAAE,EAAE;aACV,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;aAC1D,KAAK,CACJ,eAAe;aACZ,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,yBAAyB,EAAE;YAC7D,OAAO,EAAE,sCAAsC;YAC/C,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CACL;aACA,MAAM,CAAC,CAAC,CAAC,MAAM,EAAgB,CAAC;QAEnC,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAwC,CAAC;QAE3D,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aAC/C,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,sBAAsB,CAAC;QAEjC,cAAc,EAAE,EAAE;aACf,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;aACtD,KAAK,CAAC,yBAAyB,CAAC;aAChC,MAAM,CAAC,uBAAuB,CAAC;QAElC,KAAK,EAAE;YACL,KAAK,EAAE,EAAE;iBACN,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;iBAC9C,KAAK,CAAC,gBAAgB,CAAC;iBACvB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,EAAE;iBACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;iBACrD,KAAK,CAAC,iBAAiB,CAAC;iBACxB,MAAM,CAAC,oBAAoB,CAAC;SAChC;KACF;IAED,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAe,CAAC;QAEpF,aAAa,EAAE,EAAE;aACd,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvC,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,EAAQ,CAAC;QAE3B,YAAY,EAAE,EAAE;aACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,MAAM,EAA8C,CAAC;QAEjE,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aACjD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;KAC/D;CACF,CAAA"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/v1/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAWvB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAA;AAuBtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,KAAK,EAAE;QACL,MAAM,EAAE,EAAE;aACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aACzC,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAoC,CAAC;QAEvD,KAAK,EAAE,EAAE;aACN,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aAChD,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAA2B,CAAC;QAE9C,oFAAoF;QACpF,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;aAC1D,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAwB,CAAC;QAE3C,KAAK,EAAE,EAAE;aACN,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;aAChE,KAAK,CAAC,gBAAgB,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAA+B,CAAC;QAElD,6FAA6F;QAC7F,uFAAuF;QACvF,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;aACzD,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,EAAuB,CAAC;QAE1C,SAAS,EAAE,EAAE;aACV,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;aAC1D,KAAK,CACJ,eAAe;aACZ,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,yBAAyB,EAAE;YAC7D,OAAO,EAAE,sCAAsC;YAC/C,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CACL;aACA,MAAM,CAAC,CAAC,CAAC,MAAM,EAAgB,CAAC;QAEnC,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAwC,CAAC;QAE3D,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aAC/C,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,sBAAsB,CAAC;QAEjC,cAAc,EAAE,EAAE;aACf,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;aACtD,KAAK,CAAC,yBAAyB,CAAC;aAChC,MAAM,CAAC,uBAAuB,CAAC;QAElC,KAAK,EAAE;YACL,KAAK,EAAE,EAAE;iBACN,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;iBAC9C,KAAK,CAAC,gBAAgB,CAAC;iBACvB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,EAAE;iBACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;iBACrD,KAAK,CAAC,iBAAiB,CAAC;iBACxB,MAAM,CAAC,oBAAoB,CAAC;SAChC;KACF;IAED,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAe,CAAC;QAEpF,aAAa,EAAE,EAAE;aACd,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvC,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,EAAQ,CAAC;QAE3B,YAAY,EAAE,EAAE;aACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,MAAM,EAA8C,CAAC;QAEjE,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;aACjD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;KAC/D;CACF,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawcall/market",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/drawcall-ai/market",

package/src/client.ts

@@ -1,32 +1,12 @@
-import { createORPCClient } from '@orpc/client'
-import { RPCLink } from '@orpc/client/fetch'
-import type { ContractRouterClient } from '@orpc/contract'
-import type { AppContract } from './contract.js'
-import { createClient as createV1Client } from './v1/client.js'
+import {
+  createClient as createV1Client,
+  type MarketV1Client,
+  type MarketV1ClientOptions,
+} from './v1/client.js'
 
-export type MarketClient = ContractRouterClient<AppContract>
-
-const DEFAULT_BASE_URL = 'https://market.drawcall.ai'
-
-export interface MarketClientOptions {
-  baseUrl?: string
-  fetch?: typeof globalThis.fetch
-  authToken?: string
-}
-
-function buildHeaders(authToken?: string): Record<string, string> | undefined {
-  return authToken ? { authorization: `Bearer ${authToken}` } : undefined
-}
-
-export function createMarketClient(opts: MarketClientOptions = {}): MarketClient {
-  const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL
-  const link = new RPCLink({
-    url: new URL('/api/rpc', baseUrl).href,
-    fetch: opts.fetch,
-    headers: buildHeaders(opts.authToken),
-  })
-  return createORPCClient<MarketClient>(link)
-}
+/** The Market client — the v1 REST client; the RPC wire format is gone. */
+export type MarketClient = MarketV1Client
+export type MarketClientOptions = MarketV1ClientOptions
 
 /**
  * A version's zip as bytes, fetched from the content-plane URL the v1 manifest mints. The stream

package/src/commands/upload.ts

@@ -8,7 +8,7 @@ import {
   packPolicyFromInstallMetadata,
   parsePackDependencies,
 } from '../pack.js'
-import { unchangedUploadResult, uploadResult } from '../output.js'
+import { packWarnings, unchangedUploadResult, uploadResult } from '../output.js'
 import {
   assetDescriptionSchema,
   assetNameSchema,
@@ -69,6 +69,8 @@ export async function uploadCommand(
       fetchFileManifest: fileManifestForRange(client.asset),
     })
     const { zip, npmDependencies, assetDependencies, skillDependencies } = packed
+    // Loud fail-open: what pack could not verify ships in the zip — say so before publishing it.
+    for (const line of packWarnings(packed)) console.warn(line)
     const profile = await client.user.getProfile()
     if (!profile) {
       throw new Error('Not logged in. Run `market login` first.')

package/src/contract.ts

@@ -1,23 +1,3 @@
-import { oc } from '@orpc/contract'
-import { z } from 'zod'
-import type { AssetFileManifest } from './schemas.js'
-import {
-  MAX_UPLOAD_ZIP_SIZE_BYTES,
-  agentRunStatusSchema,
-  agentStartSchema,
-  agentStatusSchema,
-  assetFilesSchema,
-  exactAssetSchema,
-  fileManifestSchema,
-  generateAssetSchema,
-  generateJobStatusSchema,
-  generateResponseSchema,
-  generateStatusInputSchema,
-  listAssetsSchema,
-  updateProfileSchema,
-  uploadZipSchema,
-} from './schemas.js'
-
 export interface AssetVersion {
   id: string
   assetId: string
@@ -128,63 +108,3 @@ export interface AssetInstallMetadata {
   readAssetDependenciesFromPackageJson: boolean
   omitUnchangedInstalledFilesOnUpload: boolean
 }
-
-export const contract = {
-  asset: {
-    search: oc.input(listAssetsSchema).output(z.custom<PaginatedList<AssetSearchResult>>()),
-
-    exact: oc.input(exactAssetSchema).output(z.custom<AssetExactResult | null>()),
-
-    uploadZip: oc
-      .input(
-        uploadZipSchema
-          .extend({ zip: z.instanceof(File) })
-          .refine((input) => input.zip.size < MAX_UPLOAD_ZIP_SIZE_BYTES, {
-            message: 'Upload zip must be smaller than 1 GB',
-            path: ['zip'],
-          }),
-      )
-      .output(z.custom<AssetVersion>()),
-
-    // The derived file index of a version — every stored file's path, size and md5 etag plus the
-    // fetch-ready data-plane URLs, so installs fetch files in parallel through the same edge cache
-    // browsers warm.
-    files: oc.input(assetFilesSchema).output(z.custom<AssetFilesResult>()),
-
-    // The content hashes of a version's files, keyed by install path. Computed once from the stored
-    // source zip and cached, so a caller (e.g. `pack`) can tell whether a local file is an unchanged
-    // copy of an installed asset without keeping any hashes itself. Private assets are owner-only,
-    // same as download.
-    fileManifest: oc.input(fileManifestSchema).output(z.custom<AssetFileManifest>()),
-
-    // Generation answers immediately: `completed` for fast providers, or `pending` with an
-    // unguessable Market Workflow id for slow providers. The Workflow polls and finalizes the
-    // upstream job even when the caller disconnects; `generateStatus` only reads its state.
-    generate: oc.input(generateAssetSchema).output(generateResponseSchema),
-
-    generateStatus: oc.input(generateStatusInputSchema).output(generateJobStatusSchema),
-
-    installMetadata: oc.output(z.custom<Record<string, AssetInstallMetadata>>()),
-
-    // The agent plans, searches, judges and (where supported) generates a set of
-    // assets from a goal. `start` kicks off an async run; `status` long-polls it
-    // (blocks until the run settles or a heartbeat window elapses). The
-    // `agentAndWait` client helper drives both.
-    agent: {
-      start: oc.input(agentStartSchema).output(z.object({ runId: z.string() })),
-      status: oc.input(agentStatusSchema).output(agentRunStatusSchema),
-    },
-  },
-
-  user: {
-    getProfile: oc.output(z.custom<User | null>()),
-
-    updateProfile: oc.input(updateProfileSchema).output(z.custom<User>()),
-
-    getAuthToken: oc.output(z.custom<{ prefix: string; createdAt: Date } | null>()),
-
-    createAuthToken: oc.output(z.object({ token: z.string(), prefix: z.string() })),
-  },
-}
-
-export type AppContract = typeof contract

package/src/index.ts

@@ -1,15 +1,10 @@
-// The v1 REST surface (`/api/v1`): routed contract + typed client. Prefer this; the legacy RPC
-// client below is deprecated and retires together with `/api/rpc`.
+// The v1 REST surface (`/api/v1`): routed contract + typed client.
 export * as v1 from './v1/index.js'
 
-// Client
-export { createMarketClient, downloadAssetZipBytes } from './client.js'
+// Client (an alias of the v1 client)
+export { downloadAssetZipBytes } from './client.js'
 export type { MarketClient, MarketClientOptions } from './client.js'
 
-// Contracts
-export { contract } from './contract.js'
-export type { AppContract } from './contract.js'
-
 // Contract output types
 export type {
   Asset,
@@ -74,7 +69,7 @@ export {
   skillDependenciesSchema,
   uploadZipSchema,
   exactAssetSchema,
-  fileManifestSchema,
+  assetVersionsSchema,
   generateAssetSchema,
   updateProfileSchema,
   listAssetsSchema,
@@ -93,7 +88,8 @@ export type {
   AssetAccess,
   AssetDependencies,
   AssetDependencyValue,
-  AssetFileManifest,
+  AssetVersionListing,
+  AssetVersionsResult,
   AgentResultAsset,
   AgentResult,
   AgentRunStatus,

package/src/install-entry.ts

@@ -1,4 +1,3 @@
-export { createMarketClient } from './client.js'
 export type { MarketClient, MarketClientOptions } from './client.js'
 export { getCliClient, NotLoggedInError } from './cli-client.js'
 export type { CliClient, CliClientOptions } from './cli-client.js'

package/src/install.ts

@@ -11,15 +11,17 @@
  */
 
 import { execFile } from 'child_process'
-import { createHash } from 'crypto'
 import * as fs from 'fs/promises'
 import * as path from 'path'
 import { detectPackageManager, installDependencies } from 'nypm'
 import type { MarketClient } from './client.js'
 import type { AssetFilesResult, AssetInstallMetadata } from './contract.js'
 import { withProjectInstallLock } from './install-lock.js'
+import { md5, resolveDependencyLayout } from './pack.js'
+import { findInstallRoot, walkWithGitignore } from './project-walk.js'
 import { packageJsonAssetDependencies, parsePackageJson, type PackageJson } from './package-json.js'
 import type { ResolveResult } from './resolve.js'
+export { findInstallRoot }
 import { assetDependencyAlias, assetDependencyRange, assetDependencyValue } from './schemas.js'
 
 export interface InstallOptions {
@@ -72,6 +74,8 @@ interface DownloadResult {
   assets: InstalledAsset[]
   wrotePackageJson: boolean
   warnings: string[]
+  /** Renames adopted during this install (per asset: canonical path → adopted project path). */
+  adoptedAliases: Record<string, Record<string, string>>
 }
 
 interface DownloadOptions {
@@ -80,6 +84,14 @@ interface DownloadOptions {
   key?: string
   /** File aliases per asset name: canonical install path → the project's current path for it. */
   aliases: Record<string, Record<string, string>>
+  /** md5 of every project file, computed at most once per install (rename adoption). */
+  projectHashes: () => Promise<Map<string, string>>
+  /**
+   * Etags across an asset's published versions — the "recognized bytes" set for content-aware
+   * updates. `null` when the server cannot answer: fail-open in the conservative direction
+   * (never overwrite on uncertainty).
+   */
+  knownHashes: (name: string) => Promise<Set<string> | null>
 }
 
 export async function install(
@@ -97,6 +109,8 @@ export async function install(
     log,
     key: opts.key,
     aliases,
+    projectHashes: memoizedProjectHashes(installRoot),
+    knownHashes: memoizedKnownHashes(client),
   })
   const integration = await withProjectInstallLock(
     installRoot,
@@ -105,6 +119,7 @@ export async function install(
         rootRequests: opts.rootRequests ?? [],
         installMetadata: metadata,
         packageManagerNeeded: download.wrotePackageJson,
+        adoptedAliases: download.adoptedAliases,
       })
       if (packageJsonUpdate.packageManagerNeeded) {
         await (opts.runPackageManagerInstall ?? runPackageManagerInstall)(installRoot, log)
@@ -137,19 +152,6 @@ export async function install(
   }
 }
 
-export async function findInstallRoot(cwd: string = process.cwd()): Promise<string> {
-  const start = path.resolve(cwd)
-
-  for (let dir = start; ; dir = path.dirname(dir)) {
-    if (await isFile(path.join(dir, 'package.json'))) {
-      return dir
-    }
-    if (path.dirname(dir) === dir) {
-      return start
-    }
-  }
-}
-
 /** Max asset downloads in flight at once. Assets write disjoint file trees, so downloading them
  *  concurrently is safe and turns a ~40-asset install from serial round-trips into a few batched
  *  waves. Kept modest so one install does not itself overwhelm the worker's per-request memory. */
@@ -175,6 +177,11 @@ async function downloadAssets(
     // the package manager to bring its npm deps.
     wrotePackageJson: perAsset.some((r) => r.wrotePackageJson),
     warnings: perAsset.flatMap((r) => r.warnings),
+    adoptedAliases: Object.fromEntries(
+      perAsset
+        .filter((r) => Object.keys(r.adopted).length > 0)
+        .map((r) => [r.asset.name, r.adopted]),
+    ),
   }
 }
 
@@ -183,53 +190,78 @@ async function downloadOneAsset(
   asset: ResolveResult['assets'][number],
   projectRoot: string,
   opts: DownloadOptions,
-): Promise<{ asset: InstalledAsset; wrotePackageJson: boolean; warnings: string[] }> {
+): Promise<{
+  asset: InstalledAsset
+  wrotePackageJson: boolean
+  warnings: string[]
+  adopted: Record<string, string>
+}> {
   opts.log(`Downloading ${asset.name}@${asset.version}...`)
 
   // Only the network fetches are retried — downloads are the sole transient step; file writes are
   // deterministic local work and a failure there is a real error, not worth re-attempting.
-  const files = await fetchAssetEntries(client, asset, opts)
-  const alias = opts.aliases[asset.name] ?? {}
-  const installedFiles: string[] = []
-  const warnings: string[] = []
-  let wrotePackageJson = false
-
-  for (const [relativePath, content] of files) {
+  const entries = await fetchAssetEntries(client, asset, opts)
+  const planned = entries.flatMap((entry) => {
     const normalizedPath = safeRelativePath(
-      relativePath,
-      () => `Zip contains an unsafe path: ${relativePath}`,
+      entry.path,
+      () => `Zip contains an unsafe path: ${entry.path}`,
     )
     if (
       normalizedPath === '.' ||
       (normalizedPath === 'README.md' && asset.type !== 'template') ||
       normalizedPath.endsWith('/')
     ) {
-      continue
+      return []
     }
+    return [{ ...entry, normalizedPath }]
+  })
+
+  // Alias targets come from metadata; reject traversal before any path is stat'd or resolved —
+  // adoption must never quietly route around unsafe metadata.
+  const declaredAlias = opts.aliases[asset.name] ?? {}
+  for (const [canonical, target] of Object.entries(declaredAlias)) {
+    safeRelativePath(
+      target,
+      () => `Alias for ${canonical} in ${asset.name} is an unsafe path: ${target}`,
+    )
+  }
+  const adopted = await adoptRenamedFiles(planned, asset.name, declaredAlias, projectRoot, opts)
+  const alias = { ...declaredAlias, ...adopted }
+
+  const installedFiles: string[] = []
+  const warnings: string[] = []
+  let wrotePackageJson = false
 
-    // An alias redirects the file to where this project keeps it (a rename recorded by pack or a
-    // dependent asset). Alias targets come from metadata, so they pass the same traversal guard.
-    const aliased = alias[normalizedPath]
+  for (const entry of planned) {
+    // An alias redirects the file to where this project keeps it (a rename recorded by pack, a
+    // dependent asset, or adoption above). Alias targets pass the same traversal guard.
+    const aliased = alias[entry.normalizedPath]
     const targetPath =
       aliased === undefined
-        ? normalizedPath
+        ? entry.normalizedPath
         : safeRelativePath(
             aliased,
-            () => `Alias for ${normalizedPath} in ${asset.name} is an unsafe path: ${aliased}`,
+            () =>
+              `Alias for ${entry.normalizedPath} in ${asset.name} is an unsafe path: ${aliased}`,
           )
 
     const filePath = path.join(projectRoot, targetPath)
     const existing = await maybeReadFile(filePath)
-    if (existing && !bytesEqual(existing, content) && !opts.force) {
-      warnings.push(
-        `Skipped ${targetPath} from ${asset.name}@${asset.version}; file already exists. Re-run with --force to overwrite.`,
-      )
-      continue
+    if (existing && !bytesEqual(existing, entry.bytes)) {
+      // Recognized bytes — a published version of this same dependency file — are replaceable
+      // without --force; unrecognized bytes are the user's and keep the skip-and-warn behavior.
+      const known = opts.force ? null : await opts.knownHashes(asset.name)
+      if (!opts.force && !known?.has(md5(existing))) {
+        warnings.push(
+          `Skipped ${targetPath} from ${asset.name}@${asset.version}; file already exists. Re-run with --force to overwrite.`,
+        )
+        continue
+      }
     }
 
-    if (!existing || !bytesEqual(existing, content)) {
+    if (!existing || !bytesEqual(existing, entry.bytes)) {
       await fs.mkdir(path.dirname(filePath), { recursive: true })
-      await fs.writeFile(filePath, content)
+      await fs.writeFile(filePath, entry.bytes)
       if (targetPath === 'package.json') {
         wrotePackageJson = true
       }
@@ -249,6 +281,103 @@ async function downloadOneAsset(
     },
     wrotePackageJson,
     warnings,
+    adopted,
+  }
+}
+
+interface PlannedEntry {
+  normalizedPath: string
+  etag: string
+  bytes: Uint8Array
+}
+
+/**
+ * Install-time adoption of unsynced renames: when a file's write target is absent but identical
+ * bytes already live elsewhere in the project, that location is used instead of creating a
+ * duplicate — an implicit `sync` before writing. Uses the same layout resolution as pack/sync
+ * (recorded alias → canonical → first match), so the selection rule stays identical everywhere.
+ * The project is only hashed when some target is actually absent; a reinstall with every file in
+ * place never scans.
+ */
+async function adoptRenamedFiles(
+  planned: PlannedEntry[],
+  name: string,
+  declaredAlias: Record<string, string>,
+  projectRoot: string,
+  opts: DownloadOptions,
+): Promise<Record<string, string>> {
+  const provisionalTargets = planned.map(
+    (entry) => declaredAlias[entry.normalizedPath] ?? entry.normalizedPath,
+  )
+  if (!(await anyPathMissing(projectRoot, provisionalTargets))) return {}
+
+  const layout = resolveDependencyLayout(
+    { [name]: assetDependencyValue('*', declaredAlias) },
+    {
+      files: planned.map((entry) => ({
+        name,
+        canonicalPath: entry.normalizedPath,
+        hash: entry.etag,
+      })),
+      fetched: new Set([name]),
+    },
+    await opts.projectHashes(),
+  )
+  const resolved = assetDependencyAlias(layout.assetDependencies[name])
+  return Object.fromEntries(
+    Object.entries(resolved).filter(([canonical, target]) => declaredAlias[canonical] !== target),
+  )
+}
+
+async function anyPathMissing(projectRoot: string, targets: string[]): Promise<boolean> {
+  for (const target of targets) {
+    if (!(await isFile(path.join(projectRoot, target)))) return true
+  }
+  return false
+}
+
+/** md5 of every project file (gitignored trees excluded), computed at most once per install. */
+function memoizedProjectHashes(projectRoot: string): () => Promise<Map<string, string>> {
+  let cached: Promise<Map<string, string>> | undefined
+  return () =>
+    (cached ??= (async () => {
+      const walk = await walkWithGitignore(projectRoot)
+      const hashes = new Map<string, string>()
+      for (const relative of walk.kept) {
+        hashes.set(
+          relative,
+          md5(new Uint8Array(await fs.readFile(path.join(projectRoot, relative)))),
+        )
+      }
+      return hashes
+    })())
+}
+
+/** Newest published versions contributing to the recognized-bytes set (same bound as pack). */
+const KNOWN_HASH_VERSION_CAP = 20
+
+function memoizedKnownHashes(client: MarketClient): (name: string) => Promise<Set<string> | null> {
+  const cache = new Map<string, Promise<Set<string> | null>>()
+  return (name) => {
+    const hit = cache.get(name)
+    if (hit) return hit
+    const result = (async () => {
+      try {
+        const { versions } = await client.asset.versions({ name })
+        const recent = versions.map((entry) => entry.version).slice(-KNOWN_HASH_VERSION_CAP)
+        const etags = await Promise.all(
+          recent.map(async (version) =>
+            (await client.asset.files({ name, version })).files.map((file) => file.etag),
+          ),
+        )
+        return new Set(etags.flat())
+      } catch {
+        // Offline or not visible — the conservative fail-open: the caller keeps skip-and-warn.
+        return null
+      }
+    })()
+    cache.set(name, result)
+    return result
   }
 }
 
@@ -304,7 +433,7 @@ async function fetchAssetEntries(
   client: MarketClient,
   asset: ResolveResult['assets'][number],
   opts: DownloadOptions,
-): Promise<Array<[string, Uint8Array]>> {
+): Promise<Array<{ path: string; etag: string; bytes: Uint8Array }>> {
   const index = await client.asset.files({
     name: asset.name,
     version: asset.version,
@@ -317,7 +446,7 @@ async function fetchAssetEntries(
       attempts: DOWNLOAD_ATTEMPTS,
       onRetry: (msg) => opts.log(`Downloading ${label} ${file.path}: ${msg}`),
     })
-    return [file.path, bytes] as [string, Uint8Array]
+    return { path: file.path, etag: file.etag, bytes }
   })
 }
 
@@ -329,9 +458,9 @@ async function fetchVerifiedFile(file: AssetFilesResult['files'][number]): Promi
   const bytes = new Uint8Array(await res.arrayBuffer())
   // A digest mismatch is a corrupt transfer; thrown without a status so withRetry treats it as
   // transient and re-fetches.
-  const md5 = createHash('md5').update(bytes).digest('hex')
-  if (md5 !== file.etag) {
-    throw new Error(`md5 mismatch for ${file.path}: expected ${file.etag}, got ${md5}`)
+  const digest = md5(bytes)
+  if (digest !== file.etag) {
+    throw new Error(`md5 mismatch for ${file.path}: expected ${file.etag}, got ${digest}`)
   }
   return bytes
 }
@@ -424,6 +553,7 @@ async function updatePackageJson(
     rootRequests: InstallRootRequest[]
     installMetadata: Record<string, AssetInstallMetadata>
     packageManagerNeeded: boolean
+    adoptedAliases: Record<string, Record<string, string>>
   },
 ): Promise<{ packageManagerNeeded: boolean }> {
   const pkgPath = path.join(projectRoot, 'package.json')
@@ -448,6 +578,9 @@ async function updatePackageJson(
   if (mergeAssetDependencyRanges(pkg, assetDependencies)) {
     changed = true
   }
+  if (mergeAdoptedAliases(pkg, opts.adoptedAliases)) {
+    changed = true
+  }
 
   if (changed) {
     await fs.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n')
@@ -456,6 +589,30 @@ async function updatePackageJson(
   return { packageManagerNeeded }
 }
 
+/** Record renames adopted during this install on the entries package.json already declares —
+ *  adoption is thereby persisted, not just applied. Undeclared (transitive) deps stay out. */
+function mergeAdoptedAliases(
+  pkg: PackageJson,
+  adopted: Record<string, Record<string, string>>,
+): boolean {
+  const current = pkg.assetDependencies
+  if (!current) return false
+
+  let changed = false
+  for (const [name, alias] of Object.entries(adopted)) {
+    const existing = current[name]
+    if (existing === undefined) continue
+    const next = assetDependencyValue(assetDependencyRange(existing), {
+      ...assetDependencyAlias(existing),
+      ...alias,
+    })
+    if (JSON.stringify(existing) === JSON.stringify(next)) continue
+    current[name] = next
+    changed = true
+  }
+  return changed
+}
+
 async function runPackageManagerInstall(projectRoot: string, log: (msg: string) => void) {
   log('Installing npm dependencies...')
   const pm = await detectPackageManager(projectRoot)

package/src/output.ts

@@ -219,12 +219,34 @@ export function packResult(out: string, packed: PackedAsset): string {
   if (packed.omittedUnchangedInstalledFiles) {
     lines.push('Omitted unchanged installed dependency files.')
   }
+  lines.push(...packWarnings(packed))
   lines.push(...dependencyLines('npm dependencies', packed.npmDependencies))
   lines.push(...dependencyLines('asset dependencies', packed.assetDependencies))
   lines.push(...dependencyLines('skill dependencies', packed.skillDependencies))
   return lines.join('\n')
 }
 
+/**
+ * What pack could not check — the silent-fail-open cases with real consequences: an unfetchable
+ * dependency ships its files inside the zip, and a missing dependency file means a local edit or
+ * deletion the packer should know about.
+ */
+export function packWarnings(packed: PackedAsset): string[] {
+  const lines: string[] = []
+  if (packed.skippedDependencies.length > 0) {
+    lines.push(
+      `Dependency file indexes unavailable (their files ship in the zip): ${[...packed.skippedDependencies].sort().join(', ')}`,
+    )
+  }
+  if (packed.missingDependencyFiles.length > 0) {
+    lines.push('Dependency files not found (locally modified or deleted):')
+    lines.push(
+      ...packed.missingDependencyFiles.map((file) => `- ${file.name}: ${file.path}`).sort(),
+    )
+  }
+  return lines
+}
+
 export function previewResult(name: string, version: string, out: string): string {
   return `Saved preview for ${assetVersionRef(name, version)}: ${out}`
 }