@drawcall/market 0.6.12 → 0.7.0

package/src/commands/install.ts

@@ -6,6 +6,7 @@ import { findInstallRoot, install as runInstall, type InstallRootRequest } from
 import { packageJsonAssetDependencies } from '../package-json.js'
 import { assetDependencyRange, assetNameSchema, type AssetDependencies } from '../schemas.js'
 import { getCliClient } from '../cli-client.js'
+import { lookupAssets } from '../refs.js'
 import { installResult } from '../output.js'
 import type { MarketClient } from '../client.js'
 
@@ -82,8 +83,7 @@ export async function resolveArg(
     )
   }
 
-  const existing = await client.asset.exact({
-    name: parsed.name,
+  const [existing] = await lookupAssets(client.asset, [{ name: parsed.name }], {
     includeUnapproved,
     ...(key ? { key } : {}),
   })
@@ -91,13 +91,15 @@ export async function resolveArg(
     return {
       name: parsed.name,
       range: parsed.range,
-      saveRange: parsed.explicitRange ? parsed.range : `^${existing.latestVersion}`,
+      saveRange: parsed.explicitRange ? parsed.range : `^${existing.version}`,
       save: true,
     }
   }
 
   if (!includeUnapproved) {
-    const hidden = await client.asset.exact({ name: parsed.name, includeUnapproved: true })
+    const [hidden] = await lookupAssets(client.asset, [{ name: parsed.name }], {
+      includeUnapproved: true,
+    })
     if (hidden) {
       throw new Error(
         `Asset "${parsed.name}" exists but has no approved versions. Re-run with \`--unapproved\` if you have access.`,

package/src/commands/preview.ts

@@ -2,7 +2,9 @@ import * as fs from 'fs/promises'
 import * as path from 'path'
 import ora from 'ora'
 import { getCliClient } from '../cli-client.js'
+import type { RefsReader } from '../refs.js'
 import { previewResult } from '../output.js'
+import { lookupAssets } from '../refs.js'
 import { assetNameSchema, semverSchema } from '../schemas.js'
 
 export interface PreviewCommandOptions {
@@ -11,22 +13,8 @@ export interface PreviewCommandOptions {
   baseUrl?: string
 }
 
-interface PreviewAsset {
-  latestVersion: string
-  version?: string
-  previewUrl: string | null
-}
-
-interface PreviewClient {
-  exact(input: {
-    name: string
-    version?: string
-    includeUnapproved: boolean
-  }): Promise<PreviewAsset | null>
-}
-
 export async function resolvePreviewRef(
-  client: PreviewClient,
+  client: RefsReader,
   ref: string,
   includeUnapproved: boolean,
 ): Promise<{ name: string; version: string; previewUrl: string }> {
@@ -34,11 +22,11 @@ export async function resolvePreviewRef(
   const name = assetNameSchema.parse(separator === -1 ? ref : ref.slice(0, separator))
   const requestedVersion =
     separator === -1 ? undefined : semverSchema.parse(ref.slice(separator + 1))
-  const asset = await client.exact({
-    name,
-    ...(requestedVersion ? { version: requestedVersion } : {}),
-    includeUnapproved,
-  })
+  const [asset] = await lookupAssets(
+    client,
+    [{ name, ...(requestedVersion ? { version: requestedVersion } : {}) }],
+    { includeUnapproved },
+  )
 
   if (!asset) {
     throw new Error(`Asset "${ref}" not found`)
@@ -46,13 +34,11 @@ export async function resolvePreviewRef(
   if (!asset.previewUrl) {
     throw new Error(`Asset "${ref}" has no preview image`)
   }
-
-  const version = asset.version ?? asset.latestVersion
-  if (requestedVersion && version !== requestedVersion) {
+  if (requestedVersion && asset.version !== requestedVersion) {
     throw new Error(`Market API did not return requested version "${ref}"`)
   }
 
-  return { name, version, previewUrl: asset.previewUrl }
+  return { name, version: asset.version, previewUrl: asset.previewUrl }
 }
 
 export async function previewCommand(ref: string, opts: PreviewCommandOptions): Promise<void> {

package/src/commands/search.ts

@@ -33,6 +33,9 @@ export async function searchCommand(query: string, opts: SearchCommandOptions):
     })
     .finally(() => spinner.stop())
 
+  // The collection read is a union (search | refs); this call always searches.
+  if (!('items' in results)) throw new Error('Search unexpectedly returned a refs result.')
+
   if (opts.json) {
     // Stable machine-readable shape for scripts; the human-readable lines below may change freely.
     console.log(

package/src/commands/upload.ts

@@ -1,4 +1,5 @@
 import ora from 'ora'
+import { lookupAssets } from '../refs.js'
 import semver from 'semver'
 import { downloadAssetZipBytes } from '../client.js'
 import { getCliClient } from '../cli-client.js'
@@ -75,9 +76,7 @@ export async function uploadCommand(
     if (!profile) {
       throw new Error('Not logged in. Run `market login` first.')
     }
-    const existing = await client.asset.exact({
-      name: parsedName,
-      type,
+    const [existing] = await lookupAssets(client.asset, [{ name: parsedName }], {
       includeUnapproved: true,
     })
 
@@ -88,7 +87,7 @@ export async function uploadCommand(
     if (existing) {
       const latestBytes = await downloadAssetZipBytes({
         name: parsedName,
-        version: existing.latestVersion,
+        version: existing.version,
         baseUrl,
         authToken,
       })
@@ -100,12 +99,12 @@ export async function uploadCommand(
         bytesEqual(latestBytes, zip)
       ) {
         spinner.stop()
-        console.log(unchangedUploadResult(parsedName, existing.latestVersion))
+        console.log(unchangedUploadResult(parsedName, existing.version))
         return
       }
     }
 
-    const version = parsedVersion ?? nextVersion(existing?.latestVersion)
+    const version = parsedVersion ?? nextVersion(existing?.version)
     spinner.text = `Uploading ${parsedName}@${version}`
     const uploaded = await client.asset.uploadZip({
       name: parsedName,

package/src/install.ts

@@ -18,6 +18,7 @@ import pMap from 'p-map'
 import type { MarketClient } from './client.js'
 import type { AssetFilesResult, AssetInstallMetadata } from './contract.js'
 import { withProjectInstallLock } from './install-lock.js'
+import { lookupAssets } from './refs.js'
 import { md5, resolveDependencyLayout } from './pack.js'
 import { findInstallRoot, walkWithGitignore } from './project-walk.js'
 import { packageJsonAssetDependencies, parsePackageJson, type PackageJson } from './package-json.js'
@@ -279,14 +280,10 @@ async function downloadOneAsset(
 }> {
   opts.log(`Downloading ${asset.name}@${asset.version}...`)
 
-  // The index alone (paths + etags + fetch URLs) is enough to plan targets, adopt renames, and
-  // emit redirect rules; file bytes are fetched afterwards, and only for files actually written.
-  const index = await client.asset.files({
-    name: asset.name,
-    version: asset.version,
-    ...(opts.key ? { key: opts.key } : {}),
-  })
-  const planned = index.files.flatMap((entry) => {
+  // The file index (paths + etags + fetch URLs) arrived with the resolution —
+  // enough to plan targets, adopt renames, and emit redirect rules; file bytes
+  // are fetched afterwards, and only for files actually written.
+  const planned = asset.files.flatMap((entry) => {
     const normalizedPath = safeRelativePath(
       entry.path,
       () => `Zip contains an unsafe path: ${entry.path}`,
@@ -490,14 +487,14 @@ function memoizedKnownHashes(client: MarketClient): (name: string) => Promise<Se
     if (hit) return hit
     const result = (async () => {
       try {
-        const { versions } = await client.asset.versions({ name })
-        const recent = versions.map((entry) => entry.version).slice(-KNOWN_HASH_VERSION_CAP)
-        const etags = await Promise.all(
-          recent.map(async (version) =>
-            (await client.asset.files({ name, version })).files.map((file) => file.etag),
-          ),
+        const [latest] = await lookupAssets(client.asset, [{ name }])
+        if (!latest) return null
+        const recent = latest.versions.slice(-KNOWN_HASH_VERSION_CAP)
+        const entries = await lookupAssets(
+          client.asset,
+          recent.map((version) => ({ name, version })),
         )
-        return new Set(etags.flat())
+        return new Set(entries.flatMap((entry) => entry?.files.map((file) => file.etag) ?? []))
       } catch {
         // Offline or not visible — the conservative fail-open: the caller keeps skip-and-warn.
         return null

package/src/pack.ts

@@ -3,7 +3,6 @@ import * as fs from 'fs/promises'
 import * as path from 'path'
 import { unzipSync, zipSync } from 'fflate'
 import ignore from 'ignore'
-import pMap from 'p-map'
 import semver from 'semver'
 import {
   ALWAYS_IGNORED_DIRS,
@@ -14,6 +13,7 @@ import {
   type GitignoreMatcher,
 } from './project-walk.js'
 import type { MarketClient } from './client.js'
+import { lookupAssets } from './refs.js'
 import type { AssetInstallMetadata } from './contract.js'
 import {
   packageJsonAssetDependencies,
@@ -102,35 +102,29 @@ const MANIFEST_VERSION_CAP = 20
 export function fileManifestForRange(asset: MarketClient['asset']): FetchFileManifest {
   return async (name, range) => {
     const exact = exactRangeVersion(range)
-    if (exact) return fileIndexHashes(asset, name, exact)
-
-    const { versions } = await asset.versions({ name })
-    const inRange = versions
-      .map((entry) => entry.version)
-      .filter((version) => semver.satisfies(version, range))
-      .sort(semver.compare)
-      .slice(-MANIFEST_VERSION_CAP)
+    const inRange = exact
+      ? [exact]
+      : ((await lookupAssets(asset, [{ name }]))[0]?.versions ?? [])
+          .filter((version) => semver.satisfies(version, range))
+          .sort(semver.compare)
+          .slice(-MANIFEST_VERSION_CAP)
 
     // Oldest first, so a newer version's hash wins when a path recurs across versions.
+    const entries = await lookupAssets(
+      asset,
+      inRange.map((version) => ({ name, version })),
+    )
     const merged: Record<string, string> = {}
-    for (const hashes of await pMap(inRange, (version) => fileIndexHashes(asset, name, version), {
-      concurrency: 4,
-    })) {
-      Object.assign(merged, hashes)
+    for (const entry of entries) {
+      Object.assign(
+        merged,
+        Object.fromEntries((entry?.files ?? []).map((file) => [file.path, file.etag])),
+      )
     }
     return merged
   }
 }
 
-async function fileIndexHashes(
-  asset: MarketClient['asset'],
-  name: string,
-  version: string,
-): Promise<Record<string, string>> {
-  const index = await asset.files({ name, version })
-  return Object.fromEntries(index.files.map((file) => [file.path, file.etag]))
-}
-
 function exactRangeVersion(range: string): string | null {
   const candidate = range.trim().replace(/^=/u, '')
   return semverSchema.safeParse(candidate).success ? candidate : null

package/src/refs.ts

@@ -0,0 +1,44 @@
+import type { MarketClient } from './client.js'
+import type { AssetRefEntry } from './v1/index.js'
+
+export interface AssetRef {
+  name: string
+  version?: string
+}
+
+/** The one call the refs read needs — lets tests fake a single function. */
+export interface RefsReader {
+  search: MarketClient['asset']['search']
+}
+
+/** The server accepts up to 100 refs per read; larger sets chunk transparently. */
+const MAX_REFS_PER_CALL = 100
+
+/**
+ * The collection read in refs mode: full entries (metadata, version history,
+ * files with data-plane URLs) for exactly the given refs — order-preserved,
+ * null per miss. Version omitted resolves to the latest visible version.
+ */
+export async function lookupAssets(
+  asset: RefsReader,
+  refs: AssetRef[],
+  opts: { includeUnapproved?: boolean; key?: string } = {},
+): Promise<(AssetRefEntry | null)[]> {
+  const chunks: AssetRef[][] = []
+  for (let i = 0; i < refs.length; i += MAX_REFS_PER_CALL) {
+    chunks.push(refs.slice(i, i + MAX_REFS_PER_CALL))
+  }
+
+  const results = await Promise.all(
+    chunks.map(async (chunk) => {
+      const result = await asset.search({
+        refs: chunk.map((ref) => (ref.version ? `${ref.name}@${ref.version}` : ref.name)).join(','),
+        includeUnapproved: opts.includeUnapproved ?? false,
+        ...(opts.key ? { key: opts.key } : {}),
+      })
+      if (!('assets' in result)) throw new Error('refs read unexpectedly returned a search result')
+      return result.assets
+    }),
+  )
+  return results.flat()
+}

package/src/resolve.ts

@@ -11,7 +11,9 @@
 
 import * as semver from 'semver'
 import type { MarketClient } from './client.js'
-import type { AssetExactResult } from './contract.js'
+import type { AssetFileEntry } from './contract.js'
+import { lookupAssets } from './refs.js'
+import type { AssetRefEntry } from './v1/index.js'
 import {
   assetDependencyAlias,
   type AssetDependencyAlias,
@@ -28,6 +30,8 @@ export interface ResolvedAsset {
   npmDependencies: Record<string, string>
   assetDependencies: AssetDependencies
   skillDependencies: Record<string, string>
+  /** The resolved version's file index, carried from resolution so install needs no further reads. */
+  files: AssetFileEntry[]
 }
 
 export interface ResolveResult {
@@ -74,7 +78,7 @@ export async function resolve(
   requests: AssetRequest[],
   opts: { includeUnapproved?: boolean; key?: string } = {},
 ): Promise<ResolveResult> {
-  const metaCache = new Map<string, AssetExactResult>()
+  const metaCache = new Map<string, AssetRefEntry>()
   const includeUnapproved = opts.includeUnapproved ?? false
   let exactPins = exactPinsFor(rootConstraints(requests))
   const seenPinSets = new Set<string>()
@@ -122,7 +126,7 @@ async function resolvePass(
   requests: AssetRequest[],
   initialPins: ExactPins,
   includeUnapproved: boolean,
-  metaCache: Map<string, AssetExactResult>,
+  metaCache: Map<string, AssetRefEntry>,
   key?: string,
 ): Promise<ResolutionPass> {
   const constraints = rootConstraints(requests)
@@ -138,19 +142,34 @@ async function resolvePass(
     const names = [...new Set(wave)].filter((name) => !resolved.has(name))
     wave = []
 
-    const metas = await Promise.all(
-      names.map(async (assetName) => {
-        const constrainedExact = requiredExactVersion(assetName, constraints.get(assetName) ?? [])
-        const exactVersion = constrainedExact ?? initialPins.get(assetName) ?? null
-        return {
-          assetName,
-          exactVersion,
-          meta: await fetchMeta(client, metaCache, assetName, exactVersion, includeUnapproved, key),
-        }
-      }),
-    )
+    const wanted = names.map((assetName) => {
+      const constrainedExact = requiredExactVersion(assetName, constraints.get(assetName) ?? [])
+      const exactVersion = constrainedExact ?? initialPins.get(assetName) ?? null
+      return { assetName, exactVersion }
+    })
 
-    for (const { assetName, exactVersion, meta } of metas) {
+    // One collection read per wave; the cache spans convergence passes, so a
+    // re-pass that pins already-seen versions makes no further requests.
+    const misses = wanted.filter(
+      ({ assetName, exactVersion }) => !metaCache.has(metaKey(assetName, exactVersion)),
+    )
+    const fetched = await lookupAssets(
+      client,
+      misses.map(({ assetName, exactVersion }) => ({
+        name: assetName,
+        version: exactVersion ?? undefined,
+      })),
+      { includeUnapproved, key },
+    )
+    misses.forEach(({ assetName, exactVersion }, index) => {
+      const entry = fetched[index]
+      if (!entry) return
+      metaCache.set(metaKey(assetName, exactVersion), entry)
+      metaCache.set(metaKey(assetName, entry.version), entry)
+    })
+
+    for (const { assetName, exactVersion } of wanted) {
+      const meta = metaCache.get(metaKey(assetName, exactVersion)) ?? null
       if (!meta) {
         if (exactVersion) {
           throw new ResolutionError(
@@ -166,12 +185,13 @@ async function resolvePass(
         throw new ResolutionError(`Asset "${assetName}" has no approved versions.`)
       }
 
-      const selectedVersion = exactVersion
-        ? exactMetadataVersion(meta, assetName, exactVersion)
-        : latestMetadataVersion(meta)
-      // The meta demonstrably answers for this version; caching it under the exact key makes the
-      // convergence re-pass (which pins every asset) resolve without a single further request.
-      metaCache.set(`${assetName}@${selectedVersion}`, meta)
+      if (exactVersion && meta.version !== exactVersion) {
+        throw new ResolutionError(
+          `Market API did not return requested version "${assetName}@${exactVersion}". ` +
+            'Refusing to fall back to a different version.',
+        )
+      }
+      const selectedVersion = meta.version
       const assetDependencies = meta.assetDependencies
       resolved.set(assetName, {
         name: assetName,
@@ -181,6 +201,7 @@ async function resolvePass(
         npmDependencies: meta.npmDependencies,
         assetDependencies,
         skillDependencies: meta.skillDependencies,
+        files: meta.files,
       })
 
       for (const [dependencyName, dependencyValue] of Object.entries(assetDependencies)) {
@@ -293,28 +314,8 @@ function pinSignature(pins: ExactPins): string {
   return JSON.stringify([...pins].sort(([left], [right]) => left.localeCompare(right)))
 }
 
-async function fetchMeta(
-  client: MarketClient['asset'],
-  cache: Map<string, AssetExactResult>,
-  name: string,
-  version: string | null,
-  includeUnapproved: boolean,
-  key?: string,
-): Promise<AssetExactResult | null> {
-  const cacheKey = version ? `${name}@${version}` : name
-  const cached = cache.get(cacheKey)
-  if (cached) return cached
-  // The key is sent with every lookup in the tree; it only unlocks the asset it belongs to and is
-  // inert for the rest, so no per-asset routing is needed.
-  const meta = await client.exact({
-    name,
-    ...(version ? { version } : {}),
-    includeUnapproved,
-    ...(key ? { key } : {}),
-  })
-  if (meta) cache.set(cacheKey, meta)
-  return meta
-}
+const metaKey = (name: string, version: string | null): string =>
+  version ? `${name}@${version}` : name
 
 function requiredExactVersion(assetName: string, constraints: Constraint[]): string | null {
   const exactVersions = new Set(
@@ -335,24 +336,6 @@ function exactVersion(range: string): string | null {
   return semverSchema.safeParse(candidate).success ? candidate : null
 }
 
-function exactMetadataVersion(
-  meta: AssetExactResult,
-  assetName: string,
-  requestedVersion: string,
-): string {
-  if (meta.version === requestedVersion) return meta.version
-  throw new ResolutionError(
-    `Market API did not return requested version "${assetName}@${requestedVersion}". ` +
-      'Refusing to fall back to a different version.',
-  )
-}
-
-function latestMetadataVersion(meta: AssetExactResult): string {
-  // Older workers do not return `version`. Range requests can retain their established latest-
-  // version behavior; exact requests instead fail closed in exactMetadataVersion above.
-  return meta.version ?? meta.latestVersion
-}
-
 /**
  * Merge npm dependency ranges from all resolved assets.
  * For each package, check that all declared ranges are compatible

package/src/schemas.ts

@@ -121,6 +121,15 @@ export const exactAssetSchema = z.object({
   key: accessKeySchema.optional(),
 })
 
+// The refs mode of the collection read: `?refs=name[@version],…` returns exactly those assets —
+// full entries with files and version history — order-preserved, null per miss. Reads are plural
+// by default; a single asset is the plural of one.
+export const assetRefsSchema = z.object({
+  refs: z.string().min(1).max(4000),
+  includeUnapproved: z.boolean().default(false),
+  key: accessKeySchema.optional(),
+})
+
 export const uploadZipSchema = z.object({
   name: assetNameSchema,
   type: assetTypeSchema,

package/src/v1/contract.ts

@@ -16,6 +16,7 @@ import {
   agentStartSchema,
   agentStatusSchema,
   assetFilesSchema,
+  assetRefsSchema,
   assetVersionsSchema,
   exactAssetSchema,
   generateAssetSchema,
@@ -37,6 +38,7 @@ export interface AssetVersionManifest {
   name: string
   type: string
   version: string
+  ownerId: string
   description: string | null
   approved: boolean
   access: 'public' | 'private'
@@ -48,6 +50,16 @@ export interface AssetVersionManifest {
   zipUrl: string
 }
 
+/** One entry of the refs read: the version's full manifest plus the asset's version history
+ *  (oldest first), so range selection and multi-version hashing need no further calls. */
+export interface AssetRefEntry extends AssetVersionManifest {
+  versions: string[]
+}
+
+export interface AssetRefsResult {
+  assets: (AssetRefEntry | null)[]
+}
+
 /**
  * The v1 contract: the same procedure tree as the legacy RPC surface (so call sites migrate by
  * swapping only the client), with HTTP routes attached — served as plain REST under `/api/v1`.
@@ -55,10 +67,13 @@ export interface AssetVersionManifest {
  */
 export const contract = {
   asset: {
+    // The one collection read, discriminated by params: `?refs=name[@version],…`
+    // returns exactly those assets (full entries, order-preserved, null per
+    // miss); everything else is a search. Reads are plural by default.
     search: oc
       .route({ method: 'GET', path: '/assets' })
-      .input(listAssetsSchema)
-      .output(z.custom<PaginatedList<AssetSearchResult>>()),
+      .input(z.union([assetRefsSchema, listAssetsSchema]))
+      .output(z.custom<PaginatedList<AssetSearchResult> | AssetRefsResult>()),
 
     exact: oc
       .route({ method: 'GET', path: '/assets/{name}' })

package/src/v1/index.ts

@@ -1,2 +1,8 @@
-export { contract, type V1Contract, type AssetVersionManifest } from './contract.js'
+export {
+  contract,
+  type V1Contract,
+  type AssetVersionManifest,
+  type AssetRefEntry,
+  type AssetRefsResult,
+} from './contract.js'
 export { createClient, type MarketV1Client, type MarketV1ClientOptions } from './client.js'