@genex-ai/cli-demo 1.36.13-dev.1026 → 1.36.14-dev.1027

package/dist/index.js

@@ -754,7 +754,7 @@ function tokenizeCommand(input) {
 // src/utils/logger.ts
 function createLogger(opts = {}) {
   const out = (s) => {
-    if (!opts.quiet) writeSafely(process.stdout, s + "\n");
+    if (!opts.quiet) writeSafely(opts.toStderr ? process.stderr : process.stdout, s + "\n");
   };
   const err = (s) => {
     writeSafely(process.stderr, s + "\n");
@@ -1396,6 +1396,7 @@ var REFUSED_IN_TOOLS = /* @__PURE__ */ new Set([
   "cover",
   "make-remixable",
   "shop",
+  "items",
   "domain",
   "asset",
   "controller"
@@ -2104,13 +2105,13 @@ async function extractSourceArchive(file, dest, rootFolder) {
       cursor += 46 + nameLen + extraLen + commentLen;
     }
     if (cursor !== central.length) badArchive("Source archive directory length mismatch.");
-    const byName = new Map(entries.map((e) => [e.name.normalize("NFC").toLowerCase(), e]));
+    const byName2 = new Map(entries.map((e) => [e.name.normalize("NFC").toLowerCase(), e]));
     const sorted = [...entries].sort((a, b) => a.offset - b.offset);
     for (let i = 0; i < sorted.length; i++) {
       if (i && sorted[i].offset < sorted[i - 1].endOffset) badArchive("Source archive entries overlap.");
       const parts = sorted[i].name.split("/");
       for (let j = 1; j < parts.length; j++) {
-        const parent = byName.get(parts.slice(0, j).join("/").normalize("NFC").toLowerCase());
+        const parent = byName2.get(parts.slice(0, j).join("/").normalize("NFC").toLowerCase());
         if (parent && !parent.dir) badArchive("Source archive file/link is used as a directory.");
       }
     }
@@ -7232,11 +7233,11 @@ async function childRun(cwd, command, args, timeoutMs = 3e5) {
     env.YARN_ENABLE_IMMUTABLE_INSTALLS = "false";
     const child = spawn4(command, args, { cwd, env, shell: process.platform === "win32" && ["npm", "pnpm", "yarn", "bun"].includes(command), stdio: ["ignore", "pipe", "pipe"] });
     let tail = "";
-    const collect = (chunk) => {
+    const collect2 = (chunk) => {
       tail = (tail + chunk.toString()).slice(-8e3);
     };
-    child.stdout.on("data", collect);
-    child.stderr.on("data", collect);
+    child.stdout.on("data", collect2);
+    child.stderr.on("data", collect2);
     const timer = setTimeout(() => {
       child.kill();
       reject(new RemixError("setup_timeout", `${command} timed out. The workspace is retained; retry the same remix command.`));
@@ -8553,30 +8554,14 @@ async function runDomain(opts) {
   log.success(`${hostname} disconnected.`);
 }
 
-// src/commands/shop.ts
-var SUBS = ["list", "add", "set", "remove", "test"];
-function money(cents) {
-  return cents === void 0 ? "" : ` ($${(cents / 100).toFixed(2)})`;
-}
-async function runShop(opts) {
-  const log = createLogger({ quiet: opts.quiet });
-  const sub = opts.name?.trim() || "list";
-  if (!SUBS.includes(sub)) {
-    log.error(`Unknown subcommand ${c.cyan(sub)}. Use: ${SUBS.join(", ")}.`);
-    process.exitCode = 1;
-    return;
-  }
-  if (opts.type !== void 0 && opts.type !== "consumable" && opts.type !== "durable") {
-    log.error(`Invalid --type value for shop: ${opts.type} (consumable or durable)`);
-    process.exitCode = 1;
-    return;
-  }
+// src/lib/linked-game.ts
+async function openLinkedGame(opts, log, rerun) {
   const meta = await readProject();
   if (!meta?.id) {
     log.error("This folder isn't linked to a game.");
     log.dim(`  Run ${c.cyan("genex link")} (or ${c.cyan("genex list")} to find the slug) first.`);
     process.exitCode = 1;
-    return;
+    return null;
   }
   const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
   let token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
@@ -8584,7 +8569,7 @@ async function runShop(opts) {
     if (opts.noAuth) {
       log.error("Not signed in. Re-run without --no-auth to connect.");
       process.exitCode = 1;
-      return;
+      return null;
     }
     log.plain("Not signed in \u2014 connecting\u2026");
     try {
@@ -8597,138 +8582,1389 @@ async function runShop(opts) {
     } catch (err) {
       if (err instanceof AuthPendingError) {
         printAuthHandoff(log, err);
-        log.dim(`Then re-run ${c.cyan(`genex shop ${sub}`)}.`);
-        return;
+        log.dim(`Then re-run ${c.cyan(rerun)}.`);
+        return null;
       }
       log.error(`Sign-in didn't complete: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
-      return;
+      return null;
     }
     await writeUserToken(token, opts.envPath, apiUrl);
   }
   const auth = { Authorization: `Bearer ${token}`, "Content-Type": "application/json" };
   const call2 = (url, init) => apiFetch(url, { ...init, headers: { ...auth, ...init?.headers ?? {} } });
-  const projectSkus = `${apiUrl}/api/coin/projects/${encodeURIComponent(meta.id)}/skus`;
-  async function fail5(res2, what) {
-    if (printedStructuredError(res2)) {
-      process.exitCode = 1;
-      return;
+  return { meta, apiUrl, call: call2 };
+}
+function formatCoins(coins) {
+  return coins.toLocaleString("en-US");
+}
+function coinPrice(coins, displayUsdCents) {
+  if (coins === 0) return "Free";
+  if (displayUsdCents === void 0) return `${formatCoins(coins)} coin`;
+  const usd = (displayUsdCents / 100).toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 });
+  return `${formatCoins(coins)} coin ($${usd})`;
+}
+function priceGridLine(grid, freeAllowed) {
+  return `${[...freeAllowed ? ["Free"] : [], ...grid.map(formatCoins)].join(" \xB7 ")} coin`;
+}
+
+// src/lib/item-refusal.ts
+var ITEM_ERROR_KIND = "genex.item_error";
+var ITEM_ERROR_VERSION = 1;
+var ItemErrorCode = {
+  /** A command line the command cannot run (a missing name, a flag in the wrong place). */
+  Usage: "usage",
+  /** A name, description or tag list over its limit, judged here or by the API's validator. */
+  InvalidField: "invalid_field",
+  /** The API refused with no code the CLI can read. */
+  HttpError: "http_error",
+  /** The game folder refused to be written through (a link or a file in the way). */
+  FolderRefused: "folder_refused"
+};
+var ITEM_NAME_MAX = 80;
+var ITEM_DESCRIPTION_MAX = 1e3;
+var ITEM_TAGS_MAX = 10;
+var ITEM_TAG_LENGTH_MAX = 32;
+var FIELD_OF_KEY = {
+  name: "name",
+  description: "description",
+  tags: "tags",
+  priceCoins: "price",
+  iconUrl: "picture",
+  type: "type",
+  shareable: "shared",
+  resellable: "resellable"
+};
+var LABEL_OF_KEY = {
+  priceCoins: "price",
+  iconUrl: "picture URL (--icon)"
+};
+var formatCount = (n) => n.toLocaleString("en-US");
+function zodIssuesOf(body) {
+  if (typeof body !== "object" || body === null) return null;
+  const error = body.error;
+  if (typeof error !== "object" || error === null) return null;
+  const issues = error.issues;
+  if (!Array.isArray(issues) || issues.length === 0) return null;
+  return issues.filter((i) => typeof i === "object" && i !== null);
+}
+function issueSentence(key, index, issue) {
+  const measured = issue.type ?? issue.origin;
+  const limit = typeof issue.maximum === "number" ? formatCount(issue.maximum) : null;
+  const label = LABEL_OF_KEY[key] ?? key;
+  if (issue.code === "too_big" && limit !== null) {
+    if (key === "tags" && typeof index === "number") return `Each tag is at most ${limit} characters (tag ${index + 1} is longer).`;
+    if (measured === "array") return key === "tags" ? `An item has at most ${limit} tags.` : `The ${label} has at most ${limit} entries.`;
+    if (measured === "string") return `The ${label} is too long: at most ${limit} characters.`;
+    return `The ${label} is at most ${limit}.`;
+  }
+  if (issue.code === "too_small" && issue.minimum === 1 && measured === "string") {
+    return key === "tags" ? "A tag can't be empty." : `The ${label} can't be empty.`;
+  }
+  const detail = typeof issue.message === "string" ? `: ${issue.message}` : ".";
+  return `The ${label} was refused${detail}`;
+}
+function refusalFromBody(status2, body, fallback) {
+  const typed = body ?? {};
+  if (typeof typed.error === "string") {
+    return {
+      error: typed.error,
+      message: typeof typed.message === "string" && typed.message.trim() ? typed.message : `${fallback} (${typed.error}).`,
+      ...typeof typed.field === "string" ? { field: typed.field } : {},
+      ...typeof typed.path === "string" ? { path: typed.path } : {},
+      ...typeof typed.retryAfterMs === "number" ? { retryAfterMs: typed.retryAfterMs } : {}
+    };
+  }
+  const issues = zodIssuesOf(body);
+  if (issues) {
+    const sentences = [];
+    let field;
+    for (const issue of issues) {
+      const [key, index] = Array.isArray(issue.path) ? issue.path : [];
+      if (typeof key !== "string") continue;
+      field ??= FIELD_OF_KEY[key] ?? key;
+      const sentence = issueSentence(key, index, issue);
+      if (!sentences.includes(sentence)) sentences.push(sentence);
+    }
+    if (sentences.length > 0) {
+      return { error: ItemErrorCode.InvalidField, message: sentences.join(" "), ...field ? { field } : {} };
+    }
+  }
+  return { error: ItemErrorCode.HttpError, message: `${fallback} (HTTP ${status2}).` };
+}
+async function bodyOf(res) {
+  return res.json().catch(() => null);
+}
+function storedTags(tags2) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const tag of tags2) {
+    const stored = tag.trim().replace(/\s+/g, " ").toLowerCase();
+    if (stored) seen.add(stored);
+  }
+  return [...seen];
+}
+function checkItemWords(words2) {
+  const invalid2 = (field, message) => ({ error: ItemErrorCode.InvalidField, field, message });
+  const name = words2.name?.trim();
+  if (name !== void 0 && name.length > ITEM_NAME_MAX) {
+    return invalid2("name", `The name is too long: at most ${formatCount(ITEM_NAME_MAX)} characters (it has ${formatCount(name.length)}).`);
+  }
+  const description = words2.description?.trim();
+  if (description !== void 0 && description.length > ITEM_DESCRIPTION_MAX) {
+    return invalid2(
+      "description",
+      `The description is too long: at most ${formatCount(ITEM_DESCRIPTION_MAX)} characters (it has ${formatCount(description.length)}).`
+    );
+  }
+  if (!words2.tags) return null;
+  const tags2 = storedTags(words2.tags);
+  if (tags2.length > ITEM_TAGS_MAX) {
+    return invalid2("tags", `An item has at most ${formatCount(ITEM_TAGS_MAX)} tags (this one has ${formatCount(tags2.length)}).`);
+  }
+  const long = tags2.find((tag) => tag.length > ITEM_TAG_LENGTH_MAX);
+  if (long !== void 0) {
+    return invalid2("tags", `Each tag is at most ${formatCount(ITEM_TAG_LENGTH_MAX)} characters ("${long.slice(0, 40)}${long.length > 40 ? "\u2026" : ""}" has ${formatCount(long.length)}).`);
+  }
+  return null;
+}
+var ANSI = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
+function itemErrorDocument(refusal2) {
+  const plain = (text) => text.replace(ANSI, "").trim();
+  const hint = refusal2.hints?.map(plain).filter(Boolean).join("\n");
+  return {
+    kind: ITEM_ERROR_KIND,
+    version: ITEM_ERROR_VERSION,
+    error: refusal2.error,
+    ...refusal2.field !== void 0 ? { field: refusal2.field } : {},
+    ...refusal2.path !== void 0 ? { path: refusal2.path } : {},
+    message: plain(refusal2.message),
+    ...refusal2.id !== void 0 ? { id: refusal2.id } : {},
+    ...refusal2.retryAfterMs !== void 0 ? { retryAfterMs: refusal2.retryAfterMs } : {},
+    ...hint ? { hint } : {}
+  };
+}
+function reportItemRefusal(log, json, refusal2, printed = false) {
+  process.exitCode = 1;
+  if (!printed) {
+    const code = refusal2.error === ItemErrorCode.Usage ? "" : ` ${c.dim(`[${refusal2.error}]`)}`;
+    log.error(`${refusal2.message}${code}`);
+    for (const line of refusal2.hints ?? []) writeSafely(process.stderr, `${c.dim(`  ${line}`)}
+`);
+  }
+  if (json) writeSafely(process.stdout, `${JSON.stringify(itemErrorDocument(refusal2))}
+`);
+}
+
+// src/lib/item-media.ts
+import fs24 from "fs/promises";
+var MIB = 1024 * 1024;
+var MediaKind = { Picture: "picture", Model: "model" };
+var MediaContentType = {
+  Png: "image/png",
+  Webp: "image/webp",
+  Glb: "model/gltf-binary",
+  Zip: "application/zip"
+};
+var MEDIA_BYTES_MAX = { picture: 2 * MIB, model: 20 * MIB };
+var MEDIA_FLAG = { picture: "--image", model: "--model" };
+var ItemMediaError = class extends Error {
+};
+var startsWith = (bytes, ascii, at = 0) => bytes.length >= at + ascii.length && bytes.subarray(at, at + ascii.length).toString("latin1") === ascii;
+function pictureType(bytes) {
+  if (startsWith(bytes, "\x89PNG\r\n\n")) return MediaContentType.Png;
+  if (startsWith(bytes, "RIFF") && startsWith(bytes, "WEBP", 8)) return MediaContentType.Webp;
+  return null;
+}
+function modelType(bytes) {
+  return startsWith(bytes, "glTF") ? MediaContentType.Glb : null;
+}
+async function readItemMedia(kind, file) {
+  const flag = MEDIA_FLAG[kind];
+  if (/^https?:\/\//i.test(file)) {
+    throw new ItemMediaError(
+      kind === MediaKind.Picture ? `${flag} takes a file on this machine. For a picture that is already online, pass --icon <url>.` : `${flag} takes a .glb file on this machine.`
+    );
+  }
+  let size;
+  try {
+    const stat = await fs24.stat(file);
+    if (!stat.isFile()) throw new Error("not a file");
+    size = stat.size;
+  } catch {
+    throw new ItemMediaError(`${file} isn't a file (${flag}).`);
+  }
+  const max = MEDIA_BYTES_MAX[kind];
+  if (size > max) {
+    throw new ItemMediaError(`${file} is ${Math.ceil(size / MIB * 10) / 10} MB; ${kind === MediaKind.Picture ? "a picture" : "a model"} may be at most ${max / MIB} MB.`);
+  }
+  const bytes = await fs24.readFile(file);
+  const contentType = kind === MediaKind.Picture ? pictureType(bytes) : modelType(bytes);
+  if (!contentType) {
+    throw new ItemMediaError(
+      kind === MediaKind.Picture ? `${file} isn't a PNG or WebP picture. Render the item on a transparent background and save it as PNG.` : `${file} isn't a binary glTF model (.glb).`
+    );
+  }
+  return { kind, file, bytes, contentType };
+}
+
+// src/lib/item-package.ts
+import { createHash } from "crypto";
+import { constants as fsConstants } from "fs";
+import fs25 from "fs/promises";
+import path24 from "path";
+import zlib from "zlib";
+var MIB2 = 1024 * 1024;
+var ITEM_PACKAGE_BYTES_MAX = 50 * MIB2;
+var ITEM_PACKAGE_FILES_MAX = 2e3;
+var ITEM_PACKAGE_UNPACKED_BYTES_MAX = 200 * MIB2;
+var PackSkip = {
+  /** Git metadata, `node_modules`, `.genex/`, and secrets (`.env`, keys, `.npmrc`). */
+  Excluded: "excluded",
+  /** Never followed, wherever it points. */
+  Symlink: "symlink",
+  /** A socket, FIFO or device. */
+  NotAFile: "not_a_file",
+  /** Bigger than a whole package may be. */
+  TooLarge: "too_large",
+  /** A name another system could not write back safely (a backslash, `:`, a reserved name). */
+  UnsafeName: "unsafe_name",
+  /** A top-level `item.json`: `genex items add` writes its own there ({@link ITEM_FILE_NAME}). */
+  Reserved: "reserved",
+  /** A `genex-items/` folder: other creators' items, for integration in this game only (plan 8.1). */
+  SharedItem: "shared_item"
+};
+var PackageErrorCode = {
+  DirMissing: "package_dir_missing",
+  Empty: "package_empty",
+  TooLarge: "package_too_large",
+  TooManyFiles: "package_too_many_files",
+  /** The archive is unsafe or malformed; `path` names the entry when there is one. */
+  Invalid: "package_invalid",
+  /** The archive is well formed but is not what the API recorded for it. */
+  Mismatch: "package_mismatch",
+  DestinationExists: "package_destination_exists",
+  /** The signed link could not be read (network, expiry, an HTTP error). */
+  DownloadFailed: "package_download_failed"
+};
+var ItemPackageError = class extends Error {
+  code;
+  /** The archive path at fault, when there is one. */
+  entryPath;
+  constructor(code, message, entryPath) {
+    super(message);
+    this.code = code;
+    this.entryPath = entryPath;
+  }
+};
+var ITEM_FILE_NAME = "item.json";
+var SHARED_ITEMS_DIR = "genex-items";
+function isReservedPath(relPath) {
+  const top = relPath.split("/")[0] ?? "";
+  return top.normalize("NFC").toLowerCase() === ITEM_FILE_NAME;
+}
+function packExclusion(relPath, name) {
+  if (excludedSourcePath(relPath)) return PackSkip.Excluded;
+  if (name.toLowerCase() === SHARED_ITEMS_DIR) return PackSkip.SharedItem;
+  if (!relPath.includes("/") && isReservedPath(relPath)) return PackSkip.Reserved;
+  return null;
+}
+async function packItemDirectory(dir) {
+  const root = await realDirectory(dir);
+  const collected = { files: [], skipped: [] };
+  await collect(root, root, "", collected);
+  if (collected.files.length === 0) {
+    throw new ItemPackageError(PackageErrorCode.Empty, `${dir} has no files to package.`);
+  }
+  const zip = writeZip(collected.files);
+  if (zip.length > ITEM_PACKAGE_BYTES_MAX) {
+    throw new ItemPackageError(
+      PackageErrorCode.TooLarge,
+      `The package is ${megabytes(zip.length)} zipped; a package may be at most ${megabytes(ITEM_PACKAGE_BYTES_MAX)}.`
+    );
+  }
+  return {
+    zip,
+    files: collected.files.map((f) => ({ path: f.path, bytes: f.data.length })),
+    skipped: collected.skipped
+  };
+}
+async function realDirectory(dir) {
+  try {
+    const root = await fs25.realpath(dir);
+    if ((await fs25.stat(root)).isDirectory()) return root;
+  } catch {
+  }
+  throw new ItemPackageError(PackageErrorCode.DirMissing, `${dir} is not a folder.`);
+}
+async function insideRoot(root, candidate) {
+  try {
+    const real = await fs25.realpath(candidate);
+    return real === root || real.startsWith(root + path24.sep);
+  } catch {
+    return false;
+  }
+}
+function portableName(relPath) {
+  try {
+    validateArchivePath(relPath);
+    return true;
+  } catch (err) {
+    if (err instanceof RemixError) return false;
+    throw err;
+  }
+}
+var byName = (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+async function collect(root, abs, rel, out) {
+  const entries = (await fs25.readdir(abs, { withFileTypes: true })).sort(byName);
+  for (const entry of entries) {
+    const relPath = rel ? `${rel}/${entry.name}` : entry.name;
+    const full = path24.join(abs, entry.name);
+    const excluded = packExclusion(relPath, entry.name);
+    if (excluded) {
+      out.skipped.push({ path: relPath, reason: excluded });
+      continue;
     }
-    process.exitCode = 1;
-    const body = await res2.json().catch(() => ({}));
-    if (res2.status === 404 && body.error === "not_found") {
-      log.error("In-game purchases aren't enabled on this environment yet.");
-      return;
+    if (entry.isSymbolicLink()) {
+      out.skipped.push({ path: relPath, reason: PackSkip.Symlink });
+      continue;
+    }
+    if (entry.isDirectory()) {
+      if (await insideRoot(root, full)) await collect(root, full, relPath, out);
+      else out.skipped.push({ path: relPath, reason: PackSkip.Symlink });
+      continue;
+    }
+    if (!entry.isFile()) {
+      out.skipped.push({ path: relPath, reason: PackSkip.NotAFile });
+      continue;
     }
-    log.error(body.message ?? `Couldn't ${what} (HTTP ${res2.status}).`);
-    if (body.error === "price_off_grid") {
-      log.dim(`  See the full list any time: ${c.cyan("genex shop list")}`);
+    if (!portableName(relPath)) {
+      out.skipped.push({ path: relPath, reason: PackSkip.UnsafeName });
+      continue;
     }
-    if (body.error === "not_resellable_type") {
-      log.dim(`  Add it with ${c.cyan("--type durable")} \u2014 a consumable is used up, so there is nothing left to resell.`);
+    const read = await readRegularFile(root, full);
+    if (!Buffer.isBuffer(read)) {
+      out.skipped.push({ path: relPath, reason: read });
+      continue;
+    }
+    out.files.push({ path: relPath, data: read });
+    if (out.files.length > ITEM_PACKAGE_FILES_MAX) {
+      throw new ItemPackageError(
+        PackageErrorCode.TooManyFiles,
+        `The folder holds more than ${ITEM_PACKAGE_FILES_MAX} files; a package may hold at most that many.`
+      );
     }
   }
-  if (sub === "list") {
-    const res2 = await call2(projectSkus);
-    if (!res2.ok) return fail5(res2, "read your shop");
-    const body = await res2.json();
-    if (opts.json) {
-      log.plain(JSON.stringify(body, null, 2));
-      return;
+}
+async function readRegularFile(root, full) {
+  if (!await insideRoot(root, path24.dirname(full))) return PackSkip.Symlink;
+  let handle;
+  try {
+    handle = await fs25.open(full, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+  } catch {
+    return PackSkip.Symlink;
+  }
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile()) return PackSkip.NotAFile;
+    if (stat.size > ITEM_PACKAGE_BYTES_MAX) return PackSkip.TooLarge;
+    const data = Buffer.alloc(stat.size);
+    let filled = 0;
+    while (filled < data.length) {
+      const { bytesRead } = await handle.read(data, filled, data.length - filled, filled);
+      if (bytesRead === 0) break;
+      filled += bytesRead;
+    }
+    return data.subarray(0, filled);
+  } finally {
+    await handle.close();
+  }
+}
+var LOCAL_SIGNATURE = 67324752;
+var CENTRAL_SIGNATURE = 33639248;
+var EOCD_SIGNATURE = 101010256;
+var DESCRIPTOR_SIGNATURE = 134695760;
+var LOCAL_HEADER_BYTES = 30;
+var CENTRAL_HEADER_BYTES = 46;
+var EOCD_BYTES = 22;
+var COMMENT_MAX = 65535;
+var METHOD_STORED = 0;
+var METHOD_DEFLATE = 8;
+var FLAG_ENCRYPTED = 1;
+var FLAG_DESCRIPTOR = 8;
+var FLAG_STRONG_ENCRYPTION = 64;
+var FLAG_UTF8 = 2048;
+var FLAG_MASKED_HEADER = 8192;
+var UNIX_HOST = 3;
+var MACOS_HOST = 19;
+var VERSION = 20;
+var DOS_DATE = 1 << 5 | 1;
+var S_IFMT = 61440;
+var S_IFREG = 32768;
+var S_IFDIR = 16384;
+var FILE_MODE = 420;
+function writeZip(files) {
+  const parts = [];
+  const central = [];
+  let offset = 0;
+  for (const file of files) {
+    const name = Buffer.from(file.path, "utf8");
+    const crc = sourceCrc32(file.data);
+    const deflated = zlib.deflateRawSync(file.data, { level: 9 });
+    const stored = deflated.length >= file.data.length;
+    const body = stored ? file.data : deflated;
+    const method = stored ? METHOD_STORED : METHOD_DEFLATE;
+    const local = Buffer.alloc(LOCAL_HEADER_BYTES);
+    local.writeUInt32LE(LOCAL_SIGNATURE, 0);
+    local.writeUInt16LE(VERSION, 4);
+    local.writeUInt16LE(FLAG_UTF8, 6);
+    local.writeUInt16LE(method, 8);
+    local.writeUInt16LE(0, 10);
+    local.writeUInt16LE(DOS_DATE, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(body.length, 18);
+    local.writeUInt32LE(file.data.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    local.writeUInt16LE(0, 28);
+    const entry = Buffer.alloc(CENTRAL_HEADER_BYTES);
+    entry.writeUInt32LE(CENTRAL_SIGNATURE, 0);
+    entry.writeUInt16LE(UNIX_HOST << 8 | VERSION, 4);
+    entry.writeUInt16LE(VERSION, 6);
+    entry.writeUInt16LE(FLAG_UTF8, 8);
+    entry.writeUInt16LE(method, 10);
+    entry.writeUInt16LE(0, 12);
+    entry.writeUInt16LE(DOS_DATE, 14);
+    entry.writeUInt32LE(crc, 16);
+    entry.writeUInt32LE(body.length, 20);
+    entry.writeUInt32LE(file.data.length, 24);
+    entry.writeUInt16LE(name.length, 28);
+    entry.writeUInt32LE((S_IFREG | FILE_MODE) << 16 >>> 0, 38);
+    entry.writeUInt32LE(offset, 42);
+    parts.push(local, name, body);
+    central.push(entry, name);
+    offset += local.length + name.length + body.length;
+  }
+  const directory = Buffer.concat(central);
+  const end = Buffer.alloc(EOCD_BYTES);
+  end.writeUInt32LE(EOCD_SIGNATURE, 0);
+  end.writeUInt16LE(files.length, 8);
+  end.writeUInt16LE(files.length, 10);
+  end.writeUInt32LE(directory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...parts, directory, end]);
+}
+function invalid(message, entryPath) {
+  throw new ItemPackageError(PackageErrorCode.Invalid, message, entryPath);
+}
+function findDirectory(zip) {
+  for (let at = zip.length - EOCD_BYTES; at >= Math.max(0, zip.length - EOCD_BYTES - COMMENT_MAX); at--) {
+    if (zip.readUInt32LE(at) !== EOCD_SIGNATURE) continue;
+    if (at + EOCD_BYTES + zip.readUInt16LE(at + 20) !== zip.length) continue;
+    const count = zip.readUInt16LE(at + 10);
+    const bytes = zip.readUInt32LE(at + 12);
+    const offset = zip.readUInt32LE(at + 16);
+    const singleDisk = zip.readUInt16LE(at + 4) === 0 && zip.readUInt16LE(at + 6) === 0 && zip.readUInt16LE(at + 8) === count;
+    if (!singleDisk) invalid("The package spans several disks.");
+    if (count === 65535 || bytes === 4294967295 || offset === 4294967295) invalid("The package uses ZIP64, which a package never needs.");
+    if (offset + bytes !== at) invalid("The package's directory is not where its end record says.");
+    return { offset, bytes, count, end: at };
+  }
+  return invalid("The package is not a zip archive.");
+}
+function readEntries(zip) {
+  if (zip.length < EOCD_BYTES) invalid("The package is not a zip archive.");
+  if (zip.length > ITEM_PACKAGE_BYTES_MAX) {
+    throw new ItemPackageError(PackageErrorCode.TooLarge, `The package is over ${megabytes(ITEM_PACKAGE_BYTES_MAX)}.`);
+  }
+  const directory = findDirectory(zip);
+  if (directory.count > ITEM_PACKAGE_FILES_MAX * 2) invalid("The package holds too many entries.");
+  const entries = [];
+  const seen = /* @__PURE__ */ new Map();
+  let cursor = directory.offset;
+  let unpacked = 0;
+  for (let i = 0; i < directory.count; i++) {
+    const entry = readEntry(zip, cursor, directory.offset, directory.end);
+    cursor = entry.next;
+    const key = entry.value.path.normalize("NFC").toLowerCase();
+    if (seen.has(key)) invalid(`The package holds ${entry.value.path} twice (names that differ only in case collide on disk).`, entry.value.path);
+    seen.set(key, entry.value.dir);
+    unpacked += entry.value.size;
+    if (unpacked > ITEM_PACKAGE_UNPACKED_BYTES_MAX) invalid(`The package unpacks to more than ${megabytes(ITEM_PACKAGE_UNPACKED_BYTES_MAX)}.`);
+    entries.push(entry.value);
+  }
+  if (cursor !== directory.end) invalid("The package's directory has trailing bytes.");
+  if (entries.filter((e) => !e.dir).length > ITEM_PACKAGE_FILES_MAX) invalid(`The package holds more than ${ITEM_PACKAGE_FILES_MAX} files.`);
+  for (const entry of entries) {
+    const parts = entry.path.normalize("NFC").toLowerCase().split("/");
+    for (let depth = 1; depth < parts.length; depth++) {
+      if (seen.get(parts.slice(0, depth).join("/")) === false) invalid(`The package uses the file ${parts.slice(0, depth).join("/")} as a folder.`, entry.path);
+    }
+  }
+  const byOffset = [...entries].sort((a, b) => a.dataOffset - b.dataOffset);
+  for (let i = 1; i < byOffset.length; i++) {
+    const previous = byOffset[i - 1];
+    const current = byOffset[i];
+    if (previous && current && current.dataOffset < previous.dataEnd) invalid("The package's entries overlap.", current.path);
+  }
+  return entries;
+}
+function readEntry(zip, at, directoryStart, directoryEnd) {
+  if (at + CENTRAL_HEADER_BYTES > directoryEnd || zip.readUInt32LE(at) !== CENTRAL_SIGNATURE) invalid("The package's directory is damaged.");
+  const madeBy = zip.readUInt16LE(at + 4) >>> 8;
+  const flags = zip.readUInt16LE(at + 8);
+  const method = zip.readUInt16LE(at + 10);
+  const crc = zip.readUInt32LE(at + 16);
+  const compressedSize = zip.readUInt32LE(at + 20);
+  const size = zip.readUInt32LE(at + 24);
+  const nameLength = zip.readUInt16LE(at + 28);
+  const extraLength = zip.readUInt16LE(at + 30);
+  const commentLength = zip.readUInt16LE(at + 32);
+  const external = zip.readUInt32LE(at + 38);
+  const localOffset = zip.readUInt32LE(at + 42);
+  const next = at + CENTRAL_HEADER_BYTES + nameLength + extraLength + commentLength;
+  if (next > directoryEnd) invalid("The package's directory is damaged.");
+  const rawName = zip.subarray(at + CENTRAL_HEADER_BYTES, at + CENTRAL_HEADER_BYTES + nameLength).toString("utf8");
+  let name;
+  try {
+    name = validateArchivePath(rawName);
+  } catch (err) {
+    if (err instanceof RemixError) invalid(`The package holds an unsafe path: ${JSON.stringify(rawName)}.`, rawName);
+    throw err;
+  }
+  if (isReservedPath(name)) invalid(`The package holds its own ${ITEM_FILE_NAME}, which genex writes itself.`, name);
+  if (flags & (FLAG_ENCRYPTED | FLAG_STRONG_ENCRYPTION | FLAG_MASKED_HEADER)) invalid(`${name} is encrypted.`, name);
+  if (method !== METHOD_STORED && method !== METHOD_DEFLATE) invalid(`${name} uses a compression a package never needs.`, name);
+  const mode = madeBy === UNIX_HOST || madeBy === MACOS_HOST ? external >>> 16 & S_IFMT : 0;
+  const dir = rawName.endsWith("/") || mode === S_IFDIR;
+  if (mode !== 0 && mode !== S_IFREG && mode !== S_IFDIR) invalid(`${name} is a link or a special file, not a plain file.`, name);
+  if (dir && size !== 0) invalid(`The folder ${name} carries data.`, name);
+  if (size > ITEM_PACKAGE_BYTES_MAX) invalid(`${name} is too large.`, name);
+  if (method === METHOD_STORED && compressedSize !== size) invalid(`${name} has inconsistent sizes.`, name);
+  if (localOffset + LOCAL_HEADER_BYTES > directoryStart || zip.readUInt32LE(localOffset) !== LOCAL_SIGNATURE) invalid(`${name} has no local header.`, name);
+  const localNameLength = zip.readUInt16LE(localOffset + 26);
+  const localExtraLength = zip.readUInt16LE(localOffset + 28);
+  const localName = zip.subarray(localOffset + LOCAL_HEADER_BYTES, localOffset + LOCAL_HEADER_BYTES + localNameLength).toString("utf8");
+  if (localName !== rawName || zip.readUInt16LE(localOffset + 8) !== method) invalid(`${name}'s local header disagrees with the directory.`, name);
+  const dataOffset = localOffset + LOCAL_HEADER_BYTES + localNameLength + localExtraLength;
+  const dataEnd = dataOffset + compressedSize + (flags & FLAG_DESCRIPTOR ? 16 : 0);
+  if (dataEnd > directoryStart) invalid(`${name} is truncated.`, name);
+  if (flags & FLAG_DESCRIPTOR && zip.readUInt32LE(dataOffset + compressedSize) !== DESCRIPTOR_SIGNATURE) {
+    invalid(`${name}'s data descriptor is damaged.`, name);
+  }
+  return { value: { path: name, dir, method, crc, compressedSize, size, dataOffset, dataEnd }, next };
+}
+function entryBytes(zip, entry) {
+  const raw = zip.subarray(entry.dataOffset, entry.dataOffset + entry.compressedSize);
+  let data;
+  if (entry.method === METHOD_STORED) data = raw;
+  else {
+    try {
+      data = zlib.inflateRawSync(raw, { maxOutputLength: entry.size + 1 });
+    } catch {
+      return invalid(`${entry.path} does not decompress to its declared size.`, entry.path);
+    }
+  }
+  if (data.length !== entry.size) invalid(`${entry.path} does not decompress to its declared size.`, entry.path);
+  if (sourceCrc32(data) !== entry.crc) invalid(`${entry.path} fails its checksum.`, entry.path);
+  return data;
+}
+var sha2562 = (data) => createHash("sha256").update(data).digest("hex");
+function checkAgainstManifest(zip, files, manifest) {
+  const expected = new Map(manifest.files.map((f) => [f.path, f]));
+  if (expected.size !== manifest.files.length) throw new ItemPackageError(PackageErrorCode.Mismatch, "The package's manifest lists a file twice.");
+  for (const file of files) {
+    const want = expected.get(file.path);
+    if (!want) throw new ItemPackageError(PackageErrorCode.Mismatch, `${file.path} is in the package but not in its manifest.`, file.path);
+    if (want.bytes !== file.size || want.sha256.toLowerCase() !== sha2562(entryBytes(zip, file))) {
+      throw new ItemPackageError(PackageErrorCode.Mismatch, `${file.path} is not the file the manifest recorded.`, file.path);
+    }
+    expected.delete(file.path);
+  }
+  const missing = [...expected.keys()];
+  if (missing.length > 0) throw new ItemPackageError(PackageErrorCode.Mismatch, `The package is missing ${missing[0]}, which its manifest lists.`, missing[0]);
+}
+async function extractItemPackage(zip, dest, manifest) {
+  const entries = readEntries(zip);
+  const files = entries.filter((e) => !e.dir);
+  for (const file of files) entryBytes(zip, file);
+  if (manifest) checkAgainstManifest(zip, files, manifest);
+  try {
+    await fs25.mkdir(dest);
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      throw new ItemPackageError(PackageErrorCode.DestinationExists, `${dest} already exists.`);
+    }
+    throw err;
+  }
+  for (const entry of entries) {
+    const target = path24.join(dest, ...entry.path.split("/"));
+    if (entry.dir) {
+      await fs25.mkdir(target, { recursive: true });
+      continue;
+    }
+    await fs25.mkdir(path24.dirname(target), { recursive: true });
+    await fs25.writeFile(target, entryBytes(zip, entry), { flag: "wx", mode: FILE_MODE });
+  }
+  return files.map((f) => f.path);
+}
+function megabytes(bytes) {
+  return `${Math.round(bytes / MIB2 * 10) / 10} MB`;
+}
+
+// src/lib/item-transfer.ts
+var DOWNLOAD_TIMEOUT_MS = 12e4;
+var UPLOAD_TIMEOUT_MS = 3e5;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function isTransferUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.username || parsed.password) return false;
+  if (parsed.protocol === "https:") return true;
+  return parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname);
+}
+async function putSigned(uploadUrl, bytes, contentType) {
+  if (!isTransferUrl(uploadUrl)) throw new Error("The upload link Genex returned isn't an https URL.");
+  const res = await fetch(uploadUrl, {
+    method: "PUT",
+    headers: { "Content-Type": contentType },
+    body: bytes,
+    redirect: "error",
+    signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
+  });
+  if (!res.ok) throw new Error(`The upload was refused (HTTP ${res.status}).`);
+}
+async function downloadItemPackage(url, fetchImpl = fetch) {
+  if (!isTransferUrl(url)) {
+    throw new ItemPackageError(PackageErrorCode.Invalid, "The package link Genex returned isn't an https URL.");
+  }
+  let res;
+  try {
+    res = await fetchImpl(url, { redirect: "error", signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+  } catch (err) {
+    throw new ItemPackageError(PackageErrorCode.DownloadFailed, `The package download failed: ${err instanceof Error ? err.message : String(err)}.`);
+  }
+  if (!res.ok || !res.body) {
+    throw new ItemPackageError(PackageErrorCode.DownloadFailed, `The package download failed (HTTP ${res.status}).`);
+  }
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (declared > ITEM_PACKAGE_BYTES_MAX) {
+    await res.body.cancel().catch(() => {
+    });
+    throw new ItemPackageError(PackageErrorCode.TooLarge, "The package is over the 50 MB limit.");
+  }
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of res.body) {
+    total += chunk.length;
+    if (total > ITEM_PACKAGE_BYTES_MAX) {
+      throw new ItemPackageError(PackageErrorCode.TooLarge, "The package is over the 50 MB limit.");
     }
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+// src/commands/shop.ts
+var ITEM_DRAFT_KIND = "genex.item_draft";
+var ITEM_DRAFT_VERSION = 1;
+var SUBS = ["list", "add", "set", "remove", "test", "publish", "unpublish"];
+var STATE_LABEL = {
+  draft: "draft \u2014 not on sale yet",
+  off_sale: "off sale",
+  taken_down: "taken off sale after a complaint"
+};
+var REFUSED_FILE_CODES = /* @__PURE__ */ new Set([
+  "picture_invalid",
+  "model_invalid",
+  "media_type",
+  "media_too_large",
+  "package_invalid",
+  "package_too_large"
+]);
+var ANOTHER_FILE = { picture: "<picture.png>", model: "<file.glb>", package: "<dir>" };
+function usageRefusal(message) {
+  return { error: ItemErrorCode.Usage, message };
+}
+function clearTagsRefusal(sub, opts) {
+  if (!opts.clearTags) return null;
+  if (sub !== "set") return usageRefusal(`--clear-tags empties a listed item's tags: ${c.cyan("genex shop set <id> --clear-tags")}.`);
+  if (opts.itemTags?.length) return usageRefusal("Pass --tag (the new list) or --clear-tags (no tags), not both.");
+  return null;
+}
+async function runShop(opts) {
+  const log = createLogger({ quiet: opts.quiet, toStderr: opts.json });
+  const refuse = (refusal2) => reportItemRefusal(log, opts.json, refusal2);
+  const sub = opts.name?.trim() || "list";
+  if (!SUBS.includes(sub)) return refuse(usageRefusal(`Unknown subcommand ${c.cyan(sub)}. Use: ${SUBS.join(", ")}.`));
+  if (opts.type !== void 0 && opts.type !== "consumable" && opts.type !== "durable") {
+    return refuse({ ...usageRefusal(`Invalid --type value for shop: ${opts.type} (consumable or durable)`), field: "type" });
+  }
+  const clearTags = clearTagsRefusal(sub, opts);
+  if (clearTags) return refuse(clearTags);
+  let attachments = { media: [], pack: null };
+  if (sub === "add" || sub === "set") {
+    const words2 = checkItemWords({ name: sub === "add" ? opts.hostname : opts.rename, description: opts.description, tags: opts.itemTags });
+    if (words2) return refuse(words2);
+    const prepared = await prepareAttachments(opts, refuse);
+    if (!prepared) return;
+    attachments = prepared;
+  }
+  const game = await openLinkedGame(opts, log, `genex shop ${sub}`);
+  if (!game) return;
+  const shop = new ShopSession(game, log, opts);
+  if (sub === "list") return shop.list();
+  if (sub === "add") return shop.add(attachments);
+  const skuId = opts.hostname?.trim();
+  if (!skuId) return refuse(usageRefusal(`\`genex shop ${sub}\` needs an item id \u2014 see ${c.cyan("genex shop list")}.`));
+  if (sub === "test") return shop.testGrant(skuId);
+  if (sub === "set") return shop.set(skuId, attachments);
+  if (sub === "publish") return shop.publish(skuId);
+  if (sub === "unpublish") return shop.unpublish(skuId);
+  return shop.remove(skuId);
+}
+async function judgedMedia(kind, file) {
+  try {
+    return await readItemMedia(kind, file);
+  } catch (err) {
+    if (!(err instanceof ItemMediaError)) throw err;
+    return { error: kind === MediaKind.Picture ? "picture_invalid" : "model_invalid", field: kind, message: err.message };
+  }
+}
+async function prepareAttachments(opts, refuse) {
+  const refused = (refusal2) => {
+    refuse(refusal2);
+    return null;
+  };
+  if (opts.shared === true && opts.type === "consumable") {
+    return refused({
+      error: "not_durable",
+      field: "type",
+      message: "Only a durable item can be shared \u2014 other games keep it, and a consumable is used up. Use --type durable, or drop --shared."
+    });
+  }
+  if (opts.icon && opts.picture) {
+    return refused(usageRefusal("Pass --icon or --image, not both: --icon takes a picture URL, --image a picture file on this machine."));
+  }
+  const media = [];
+  for (const [kind, file] of [[MediaKind.Picture, opts.picture], [MediaKind.Model, opts.modelFile]]) {
+    if (!file) continue;
+    const judged = await judgedMedia(kind, file);
+    if ("error" in judged) return refused(judged);
+    media.push(judged);
+  }
+  let pack2 = null;
+  if (opts.packageDir) {
+    try {
+      pack2 = await packItemDirectory(opts.packageDir);
+    } catch (err) {
+      if (err instanceof ItemPackageError) return refused({ error: "package_invalid", field: "package", message: `${err.message} (--package)` });
+      throw err;
+    }
+  }
+  return { media, pack: pack2 };
+}
+var SKIP_REASON = {
+  excluded: "machine state or a secret",
+  symlink: "a link \u2014 links are never followed",
+  not_a_file: "not a regular file",
+  too_large: "too large for any package",
+  unsafe_name: "a name other systems cannot write back",
+  reserved: "genex items add writes its own item.json there",
+  shared_item: "other creators' items are for this game only"
+};
+var ShopSession = class {
+  game;
+  log;
+  opts;
+  projectSkus;
+  constructor(game, log, opts) {
+    this.game = game;
+    this.log = log;
+    this.opts = opts;
+    this.projectSkus = `${game.apiUrl}/api/coin/projects/${encodeURIComponent(game.meta.id)}/skus`;
+  }
+  skuUrl(skuId) {
+    return `${this.game.apiUrl}/api/coin/skus/${encodeURIComponent(skuId)}`;
+  }
+  post(url, body) {
+    return this.game.call(url, { method: "POST", ...body === void 0 ? {} : { body: JSON.stringify(body) } });
+  }
+  /** stdout, whole: the one document a `--json` run prints. */
+  printJson(value, pretty = true) {
+    writeSafely(process.stdout, `${pretty ? JSON.stringify(value, null, 2) : JSON.stringify(value)}
+`);
+  }
+  /**
+   * The draft document: the item flattened with `kind` and `version`. Only an
+   * API that speaks the store contract (it sends `state`) gets the stamp; an
+   * older one's bare item prints as it always did, so the app can never
+   * mistake it for a draft.
+   */
+  printDraft(sku) {
+    if (typeof sku.state === "string") this.printJson({ kind: ITEM_DRAFT_KIND, version: ITEM_DRAFT_VERSION, ...sku }, false);
+    else this.printJson(sku);
+  }
+  /** Print a refusal this command decided itself (exit code 1). */
+  refuse(refusal2) {
+    reportItemRefusal(this.log, this.opts.json, refusal2);
+  }
+  /** The server's price grid, or null when it cannot be read. */
+  async priceGrid() {
+    const res = await this.game.call(this.projectSkus).catch(() => null);
+    if (!res?.ok) return null;
+    const body = await res.json().catch(() => null);
+    const grid = body?.priceGrid;
+    return Array.isArray(grid) && grid.every((n) => typeof n === "number") ? grid : null;
+  }
+  /**
+   * Does this server take a price of 0 (Free)? Only while its item store is
+   * on (contract D7); the store routes answer then and 404 otherwise, the
+   * probe the MCP connector's `item_draft` makes too. Unknown reads as no, so
+   * Free is never offered where it would be refused.
+   */
+  async freeAllowed() {
+    const res = await this.game.call(`${this.game.apiUrl}/api/store/catalog?limit=1`).catch(() => null);
+    return res?.ok === true;
+  }
+  /** The grid line every price hint prints, or null when the grid cannot be read. */
+  async gridLine() {
+    const [grid, free] = await Promise.all([this.priceGrid(), this.freeAllowed()]);
+    return grid ? priceGridLine(grid, free) : null;
+  }
+  /** Report a refused API answer (exit code 1): the person's line and hints, and the `--json` document. */
+  async fail(res, what, skuId) {
+    const printed = printedStructuredError(res);
+    reportItemRefusal(this.log, this.opts.json, await this.refusalFor(res, what, skuId, printed), printed);
+  }
+  /** One place to turn an API refusal into something actionable. */
+  async refusalFor(res, what, skuId, printed) {
+    const refusal2 = refusalFromBody(res.status, await bodyOf(res), `Couldn't ${what}`);
+    if (res.status === 404 && refusal2.error === "not_found") {
+      return { ...refusal2, message: "In-game purchases aren't enabled on this environment yet." };
+    }
+    if (skuId && refusal2.error === "project_not_found") return { ...refusal2, message: "That item is not yours (or does not exist)." };
+    if (printed) return refusal2;
+    return this.withHints(refusal2, skuId ?? "<id>");
+  }
+  /** The next step for each refusal the creator can act on. */
+  async withHints(refusal2, id) {
+    const hint = (...hints) => ({ ...refusal2, hints });
+    const media = refusal2.field === "model" ? { flag: "--model", file: ANOTHER_FILE.model } : { flag: "--image", file: ANOTHER_FILE.picture };
+    switch (refusal2.error) {
+      case "price_off_grid":
+      case "bad_price": {
+        const grid = await this.gridLine();
+        const price = this.opts.price;
+        const named = grid && refusal2.error === "price_off_grid" && price !== void 0;
+        return {
+          ...refusal2,
+          ...named ? { message: `${formatCoins(price)} coin isn't one of this game's prices.` } : {},
+          hints: [...grid ? [`Prices available: ${grid}`] : [], `See the full list any time: ${c.cyan("genex shop list")}`]
+        };
+      }
+      case "not_resellable_type":
+        return hint(`Add it with ${c.cyan("--type durable")} \u2014 a consumable is used up, so there is nothing left to resell.`);
+      case "not_durable":
+        return hint(`Only a durable item can be shared: ${c.cyan(`genex shop set ${id} --type durable`)} first.`);
+      case "picture_missing":
+        return hint(`Render the item on a transparent background, then: ${c.cyan(`genex shop set ${id} --image <picture.png>`)}`);
+      case "picture_invalid":
+      case "media_type":
+      case "media_too_large":
+        return hint(`A picture is a PNG or WebP up to 2 MB, a model a .glb up to 20 MB: ${c.cyan(`genex shop set ${id} ${media.flag} ${media.file}`)}`);
+      case "model_invalid":
+        return hint(`Replace it with another GLB: ${c.cyan(`genex shop set ${id} --model ${ANOTHER_FILE.model}`)}`);
+      case "package_invalid":
+        return hint(
+          `The package holds ${refusal2.path ?? "a path"} that a package may not (a link, an absolute or a ../ path). Fix the folder, then ${c.cyan(`genex shop set ${id} --package <dir>`)}.`
+        );
+      case "package_too_large":
+        return hint("A package may be at most 50 MB zipped.");
+      case "name_refused":
+        return hint(`Rename it: ${c.cyan(`genex shop set ${id} --rename "<name>"`)}`);
+      case "description_refused":
+        return hint(`Rewrite it: ${c.cyan(`genex shop set ${id} --description "<text>"`)}`);
+      case "taken_down":
+        return hint("An admin took this item off sale after a complaint. It can't go back on sale; its owners keep it.");
+      case "publish_rate_limited":
+        return hint(`Too many items put on sale today. Try again in ${Math.max(1, Math.ceil((refusal2.retryAfterMs ?? 0) / 6e4))} minutes.`);
+      case "too_many_skus":
+        return hint(`Retire an item this game no longer sells: ${c.cyan("genex shop remove <id>")}`);
+      case "type_locked":
+        return hint("Someone already owns it, so its type can no longer change.");
+      default:
+        return refusal2;
+    }
+  }
+  async list() {
+    const [res, free] = await Promise.all([this.game.call(this.projectSkus), this.opts.json ? false : this.freeAllowed()]);
+    if (!res.ok) return this.fail(res, "read your shop");
+    const body = await res.json();
+    if (this.opts.json) return this.printJson(body);
+    const { log } = this;
+    const prices = `Prices available: ${priceGridLine(body.priceGrid, free)}`;
     if (body.items.length === 0) {
       log.plain("This game sells nothing yet.");
       log.dim(`  Add something: ${c.cyan('genex shop add "Iron Key" --price 100')}`);
-      log.dim(`  Prices available: ${body.priceGrid.join(", ")} coin`);
+      log.dim(`  ${prices}`);
       return;
     }
     log.plain(`${body.items.length} item${body.items.length === 1 ? "" : "s"}:`);
     for (const s of body.items) {
-      const state = s.active ? "" : c.dim(" (retired)");
+      const label = s.retired ? "retired" : s.state === void 0 ? s.active ? null : "retired" : STATE_LABEL[s.state] ?? null;
+      const state = label ? c.dim(` (${label})`) : "";
+      const shared = s.shareable ? c.dim(" \xB7 other games can use it") : "";
       const resale = s.resellable ? c.dim(" \xB7 resellable") : "";
-      log.plain(
-        `  ${c.cyan(s.id)}  ${s.name} \u2014 ${s.priceCoins} coin${money(s.priceDisplayUsdCents)}  ${c.dim(s.type)}${resale}${state}`
-      );
+      log.plain(`  ${c.cyan(s.id)}  ${s.name} \u2014 ${coinPrice(s.priceCoins, s.priceDisplayUsdCents)}  ${c.dim(s.type)}${shared}${resale}${state}`);
     }
-    log.dim(`Prices available: ${body.priceGrid.join(", ")} coin`);
-    return;
+    log.dim(prices);
   }
-  if (sub === "add") {
+  async add(attachments) {
+    const { log, opts } = this;
     const name = opts.hostname?.trim();
-    if (!name) {
-      log.error(`\`genex shop add\` needs a name, e.g. ${c.cyan('genex shop add "Iron Key" --price 100')}.`);
-      process.exitCode = 1;
-      return;
-    }
-    if (!opts.price) {
-      log.error(`\`genex shop add\` needs ${c.cyan("--price")}, in coin.`);
-      process.exitCode = 1;
-      return;
-    }
-    const res2 = await call2(projectSkus, {
-      method: "POST",
-      body: JSON.stringify({
-        name,
-        priceCoins: opts.price,
-        type: opts.type === "durable" ? "durable" : "consumable",
-        ...opts.icon ? { iconUrl: opts.icon } : {},
-        ...opts.resellable !== void 0 ? { resellable: opts.resellable } : {}
-      })
+    if (!name) return this.refuse(usageRefusal(`\`genex shop add\` needs a name, e.g. ${c.cyan('genex shop add "Iron Key" --price 100')}.`));
+    if (opts.price === void 0) return this.refuse(usageRefusal(`\`genex shop add\` needs ${c.cyan("--price")}, in coin (0 is Free).`));
+    const type = opts.type ?? (opts.shared ? "durable" : "consumable");
+    const res = await this.post(this.projectSkus, {
+      name,
+      priceCoins: opts.price,
+      type,
+      ...opts.description ? { description: opts.description } : {},
+      ...opts.itemTags?.length ? { tags: opts.itemTags } : {},
+      ...opts.icon ? { iconUrl: opts.icon } : {},
+      ...opts.shared !== void 0 ? { shareable: opts.shared } : {},
+      ...opts.resellable !== void 0 ? { resellable: opts.resellable } : {}
     });
-    if (!res2.ok) return fail5(res2, "add that item");
-    const sku = await res2.json();
-    if (opts.json) {
-      log.plain(JSON.stringify(sku, null, 2));
-      return;
-    }
-    log.success(`Added ${c.cyan(sku.name)} \u2014 ${sku.priceCoins} coin.`);
+    if (!res.ok) return this.fail(res, "add that item");
+    const created = await res.json();
+    const attached = await this.attach(created.id, created, attachments);
+    if (!attached) return;
+    const sku = attached.sku ?? created;
+    if (opts.json) return this.printDraft(sku);
+    const draft = sku.state === "draft";
+    log.success(`Added ${c.cyan(sku.name)} \u2014 ${coinPrice(sku.priceCoins, sku.priceDisplayUsdCents)}${draft ? ", as a draft" : ""}.`);
     log.plain(`  id: ${c.cyan(sku.id)}`);
     log.dim(`  Use it in the game: buy({ skuId: "${sku.id}" })`);
     if (sku.resellable) log.dim("  Players can resell this to each other on the market.");
-    return;
-  }
-  const skuId = opts.hostname?.trim();
-  if (!skuId) {
-    log.error(`\`genex shop ${sub}\` needs an item id \u2014 see ${c.cyan("genex shop list")}.`);
-    process.exitCode = 1;
-    return;
+    if (draft) {
+      log.dim("  It is not on sale yet: the person puts it on sale in the Genex app (Create \u203A Items \u203A Selling);");
+      log.dim(`  from a terminal: ${c.cyan(`genex shop publish ${sku.id}`)}`);
+    }
   }
-  const skuUrl = `${apiUrl}/api/coin/skus/${encodeURIComponent(skuId)}`;
-  if (sub === "test") {
-    const res2 = await call2(`${skuUrl}/test-grant`, { method: "POST" });
-    if (!res2.ok) return fail5(res2, "grant yourself a test copy");
-    const got = await res2.json();
+  async set(skuId, attachments) {
+    const { log, opts } = this;
+    const patch = {};
+    if (opts.rename) patch.name = opts.rename;
+    if (opts.price !== void 0) patch.priceCoins = opts.price;
+    if (opts.type !== void 0) patch.type = opts.type;
+    if (opts.description !== void 0) patch.description = opts.description.trim() === "" ? null : opts.description;
+    if (opts.itemTags?.length) patch.tags = opts.itemTags;
+    if (opts.clearTags) patch.tags = [];
+    if (opts.icon) patch.iconUrl = opts.icon;
+    if (opts.shared !== void 0) patch.shareable = opts.shared;
+    if (opts.resellable !== void 0) patch.resellable = opts.resellable;
+    const uploads = attachments.media.length > 0 || attachments.pack !== null;
+    if (Object.keys(patch).length === 0 && !uploads) {
+      const flags = ["--rename", "--price", "--icon", "--image", "--model", "--package", "--description", "--tag", "--clear-tags", "--shared"].map((f) => c.cyan(f));
+      return this.refuse(usageRefusal(`Nothing to change. Pass ${flags.join(", ")} or ${c.cyan("--resellable")}.`));
+    }
+    let sku = null;
+    if (Object.keys(patch).length > 0) {
+      const res = await this.game.call(this.skuUrl(skuId), { method: "PATCH", body: JSON.stringify(patch) });
+      if (!res.ok) return this.fail(res, "update that item", skuId);
+      sku = await res.json();
+    }
+    const attached = await this.attach(skuId, sku, attachments);
+    const finished = attached?.sku;
+    if (!finished) return;
+    if (opts.json) return this.printDraft(finished);
+    log.success(`Updated ${c.cyan(finished.name)} \u2014 ${coinPrice(finished.priceCoins, finished.priceDisplayUsdCents)}.`);
+    if (opts.resellable === false) log.dim("  Listings already on the market stay up.");
+    if (opts.shared === false) log.dim("  Games that already added it keep it; no new game can add it.");
+  }
+  /**
+   * Upload the picture, the model and the package to an item that exists:
+   * upload-url → PUT to the signed URL → commit, each answering the item as it
+   * now stands. Resolves the item after the last commit (`sku` itself when
+   * there was nothing to upload), or null when an upload was refused —
+   * printed, with the item's id and the command that finishes it, because the
+   * item itself already exists.
+   */
+  async attach(skuId, sku, attachments) {
+    let current = sku;
+    const skuUrl = this.skuUrl(skuId);
+    const parts = [
+      ...attachments.media.map((m) => ({ flag: m.kind === MediaKind.Picture ? "--image" : "--model", source: m.file, kind: m.kind, bytes: m.bytes, contentType: m.contentType })),
+      ...attachments.pack ? [{ flag: "--package", source: this.opts.packageDir ?? "<dir>", kind: "package", bytes: attachments.pack.zip, contentType: MediaContentType.Zip }] : []
+    ];
+    if (attachments.pack) this.reportSkipped(attachments.pack);
+    for (const part of parts) {
+      const unfinished = (refusal2, printed = false) => {
+        const file = REFUSED_FILE_CODES.has(refusal2.error) ? ANOTHER_FILE[part.kind] : part.source;
+        const finish2 = `The item ${skuId} exists, but its ${part.kind} did not upload. Finish it with: genex shop set ${skuId} ${part.flag} ${file}`;
+        reportItemRefusal(this.log, this.opts.json, { ...refusal2, id: skuId, hints: [...refusal2.hints ?? [], finish2] }, printed);
+        if (printed) this.log.error(finish2);
+        return null;
+      };
+      const refused = async (res, what) => {
+        const printed = printedStructuredError(res);
+        return unfinished(await this.refusalFor(res, what, skuId, printed), printed);
+      };
+      const isPackage = part.kind === "package";
+      const base = isPackage ? `${skuUrl}/package` : `${skuUrl}/media`;
+      this.log.dim(`Uploading the ${part.kind} (${part.bytes.length} bytes)\u2026`);
+      const urlRes = await this.post(`${base}/upload-url`, isPackage ? { bytes: part.bytes.length } : { kind: part.kind, bytes: part.bytes.length, contentType: part.contentType });
+      if (!urlRes.ok) return refused(urlRes, `upload the ${part.kind}`);
+      const { uploadUrl, key } = await urlRes.json();
+      try {
+        await putSigned(uploadUrl, part.bytes, part.contentType);
+      } catch (err) {
+        return unfinished({ error: "media_upload_failed", field: part.kind, message: err instanceof Error ? err.message : String(err) });
+      }
+      const commit = await this.post(base, isPackage ? { key } : { kind: part.kind, key });
+      if (!commit.ok) return refused(commit, `attach the ${part.kind}`);
+      current = await commit.json();
+    }
+    return { sku: current };
+  }
+  reportSkipped(pack2) {
+    this.log.dim(`Packaging ${pack2.files.length} file${pack2.files.length === 1 ? "" : "s"}.`);
+    if (pack2.skipped.length === 0) return;
+    this.log.dim("Left out of the package:");
+    for (const s of pack2.skipped) this.log.dim(`  ${s.path} (${SKIP_REASON[s.reason]})`);
+  }
+  async testGrant(skuId) {
+    const { log } = this;
+    const res = await this.post(`${this.skuUrl(skuId)}/test-grant`);
+    if (!res.ok) return this.fail(res, "grant yourself a test copy", skuId);
+    const got = await res.json();
     log.success(`You now own ${c.cyan(got.name)} in this game.`);
     log.dim("  It cost nothing and no sale was recorded \u2014 it is a test copy.");
     log.dim(
       got.skuType === "durable" ? "  Reload the game: it should appear in your inventory." : "  Reload the game: it should be delivered and consumed once."
     );
-    return;
   }
-  if (sub === "set") {
-    const patch = {};
-    if (opts.rename) patch.name = opts.rename;
-    if (opts.price) patch.priceCoins = opts.price;
-    if (opts.icon) patch.iconUrl = opts.icon;
-    if (opts.resellable !== void 0) patch.resellable = opts.resellable;
-    if (Object.keys(patch).length === 0) {
-      log.error(
-        `Nothing to change. Pass ${c.cyan("--rename")}, ${c.cyan("--price")}, ${c.cyan("--icon")} or ${c.cyan("--resellable")}.`
-      );
-      process.exitCode = 1;
+  async publish(skuId) {
+    const res = await this.post(`${this.skuUrl(skuId)}/publish`);
+    if (!res.ok) return this.fail(res, "put that item on sale", skuId);
+    const sku = await res.json();
+    if (this.opts.json) return this.printJson(sku);
+    this.log.success(`${c.cyan(sku.name)} is on sale \u2014 ${coinPrice(sku.priceCoins, sku.priceDisplayUsdCents)}.`);
+    this.log.dim("  Players can buy it in this game's store now.");
+  }
+  async unpublish(skuId) {
+    const res = await this.post(`${this.skuUrl(skuId)}/unpublish`);
+    if (!res.ok) return this.fail(res, "take that item off sale", skuId);
+    const sku = await res.json();
+    if (this.opts.json) return this.printJson(sku);
+    this.log.success(`${c.cyan(sku.name)} is off sale.`);
+    this.log.dim("  Players who already own it keep it.");
+  }
+  async remove(skuId) {
+    const res = await this.game.call(this.skuUrl(skuId), { method: "DELETE" });
+    if (!res.ok) return this.fail(res, "remove that item", skuId);
+    this.log.success("Removed from the shop.");
+    this.log.dim("  Players who already bought it keep it.");
+  }
+};
+
+// src/commands/items.ts
+import crypto6 from "crypto";
+import fs26 from "fs/promises";
+import path25 from "path";
+var SUBS2 = ["search", "add", "remove", "list"];
+var ITEMS_DIR = SHARED_ITEMS_DIR;
+var REPLACED_DIR = ".genex/replaced-items";
+var ITEM_FILE = ITEM_FILE_NAME;
+var ITEM_ID = /^[A-Za-z0-9_-]{1,64}$/;
+async function runItems(opts) {
+  const log = createLogger({ quiet: opts.quiet, toStderr: opts.json });
+  const usage = (message, hints) => reportItemRefusal(log, opts.json, { error: ItemErrorCode.Usage, message, ...hints ? { hints } : {} });
+  const sub = opts.name?.trim() || "list";
+  if (!SUBS2.includes(sub)) return usage(`Unknown subcommand ${c.cyan(sub)}. Use: ${SUBS2.join(", ")}.`);
+  const arg = opts.query?.trim() ?? "";
+  if (sub === "search" && !arg && !opts.itemTags?.length) {
+    return usage(`\`genex items search\` needs words or a --tag, e.g. ${c.cyan('genex items search "wings" --tag fire')}.`);
+  }
+  if ((sub === "add" || sub === "remove") && !ITEM_ID.test(arg)) {
+    return usage(arg ? `${JSON.stringify(arg)} isn't an item id.` : `\`genex items ${sub}\` needs an item id.`, [
+      `Find one with ${c.cyan('genex items search "<words>"')} (or ${c.cyan("genex items list")}).`
+    ]);
+  }
+  const game = await openLinkedGame(opts, log, `genex items ${sub}`);
+  if (!game) return;
+  const items = new ItemsSession(game, log, opts);
+  if (sub === "search") return items.search(arg);
+  if (sub === "add") return items.add(arg);
+  if (sub === "remove") return items.remove(arg);
+  return items.list();
+}
+var ADD_REFUSAL_HINT = {
+  not_shareable: "Its author no longer lets other games add it; games that already did keep it.",
+  home_game: "This is the item's own game: it is already in its store.",
+  item_off_sale: "Only an item on sale can be added.",
+  taken_down: "Only an item on sale can be added."
+};
+function sharePercent(bps) {
+  if (typeof bps !== "number" || !Number.isInteger(bps) || bps < 0 || bps > 1e4) return null;
+  return `${Number((bps / 100).toFixed(2))}%`;
+}
+var ItemsSession = class _ItemsSession {
+  game;
+  log;
+  opts;
+  allowances;
+  constructor(game, log, opts) {
+    this.game = game;
+    this.log = log;
+    this.opts = opts;
+    this.allowances = `${game.apiUrl}/api/store/projects/${encodeURIComponent(game.meta.id)}/allowances`;
+  }
+  printJson(value) {
+    writeSafely(process.stdout, `${JSON.stringify(value, null, 2)}
+`);
+  }
+  /** One place to turn an API refusal into a sentence (and, under --json, the refusal document). */
+  async fail(res, what) {
+    const printed = printedStructuredError(res);
+    const refusal2 = refusalFromBody(res.status, await bodyOf(res), `Couldn't ${what}`);
+    reportItemRefusal(this.log, this.opts.json, _ItemsSession.worded(res.status, refusal2), printed);
+  }
+  /** The refusal in this command's words: the store switched off, and the hints a host can act on. */
+  static worded(status2, refusal2) {
+    if (status2 === 404 && refusal2.error === "not_found") return { ...refusal2, message: "The item store isn't enabled on this environment yet." };
+    const hint = ADD_REFUSAL_HINT[refusal2.error];
+    return hint ? { ...refusal2, hints: [hint] } : refusal2;
+  }
+  /** Print a refusal this command decided itself (exit code 1). */
+  refuse(refusal2) {
+    reportItemRefusal(this.log, this.opts.json, refusal2);
+  }
+  async search(words2) {
+    const qs = new URLSearchParams();
+    if (words2) qs.set("q", words2);
+    if (this.opts.itemTags?.length) qs.set("tags", this.opts.itemTags.join(","));
+    const res = await this.game.call(`${this.game.apiUrl}/api/store/catalog?${qs}`);
+    if (!res.ok) return this.fail(res, "search the items");
+    const body = await res.json();
+    if (this.opts.json) return this.printJson(body);
+    const { log } = this;
+    if (body.items.length === 0) {
+      log.plain("No shared items match.");
       return;
     }
-    const res2 = await call2(skuUrl, { method: "PATCH", body: JSON.stringify(patch) });
-    if (!res2.ok) return fail5(res2, "update that item");
-    const sku = await res2.json();
-    log.success(`Updated ${c.cyan(sku.name)} \u2014 ${sku.priceCoins} coin.`);
-    if (opts.resellable === false) log.dim("  Listings already on the market stay up.");
+    const share = sharePercent(body.sellerShareBps);
+    if (share) log.plain(`  Your game gets ${share} of every sale of an item it adds; the author and Genex share the rest.`);
+    for (const item of body.items) {
+      const reach = item.gamesCount === 1 ? "in 1 game" : `in ${item.gamesCount} games`;
+      log.plain(`  ${c.cyan(item.id)}  ${item.name} \u2014 ${coinPrice(item.priceCoins, item.priceDisplayUsdCents)} \xB7 ${reach} \xB7 by ${item.author.name}`);
+      log.dim(`      you get ${formatCoins(item.youGetPerSale)} coin per sale${item.tags.length ? ` \xB7 ${item.tags.join(", ")}` : ""}`);
+      if (item.description) log.dim(`      ${item.description.length > 120 ? `${item.description.slice(0, 117)}\u2026` : item.description}`);
+    }
+    if (body.nextCursor) log.dim("  More match: narrow the search with more words or a --tag.");
+    log.dim(`  Add one to this game: ${c.cyan(`genex items add ${body.items[0]?.id ?? "<id>"}`)} (free; players who own it can use it here)`);
+  }
+  /**
+   * Allow the item here, then write its folder: the package (validated whole)
+   * and item.json. The allowance is server state; when the folder cannot be
+   * written the item stays added and the command says how to fetch it again.
+   */
+  async add(skuId) {
+    const { log } = this;
+    const added = await this.game.call(this.allowances, { method: "POST", body: JSON.stringify({ skuId }) });
+    if (!added.ok) return this.fail(added, "add that item");
+    const { allowance, package: link, replayed } = await added.json();
+    const item = await this.describe(skuId);
+    if (!item) return;
+    const pkg = link ? await this.packageLink(skuId) : null;
+    if (link && !pkg) return;
+    const itemFile = { ...item, manifest: pkg?.manifest ?? null, addedAt: allowance.addedAt };
+    let files;
+    try {
+      files = await this.writeItemFolder(skuId, itemFile, pkg);
+    } catch (err) {
+      if (err instanceof ItemPackageError) return this.refuse(packageRefusal(skuId, item.name, err));
+      if (err instanceof FolderRefused) return this.refuse(folderRefusal(skuId, item.name, err));
+      throw err;
+    }
+    const dir = `${ITEMS_DIR}/${skuId}`;
+    if (this.opts.json) return this.printJson({ allowance, item: itemFile, dir, files, replayed });
+    const author = item.author ? ` by ${item.author.name}` : "";
+    log.success(`${c.cyan(item.name)}${author} is added to this game \u2014 ${coinPrice(item.priceCoins, item.priceDisplayUsdCents)}.`);
+    log.plain(`  ${dir}/${ITEM_FILE}${files.length ? ` and its package (${files.length} file${files.length === 1 ? "" : "s"})` : ""}.`);
+    log.dim("  Another creator's files: use them as reference material, and review any code before you run it.");
+    log.dim(`  Next, follow the genex-items skill: decide how it looks and works in this game, wire it to`);
+    log.dim(`  buy({ skuId: "${skuId}" }) and apply it from getEntitlements() at boot.`);
+    log.dim("  It shows in this game's store once you release a new build.");
+    log.dim(`  Release one with ${c.cyan("genex publish")} (or ${c.cyan("genex preview")}, then ${c.cyan("genex promote")}) once it works in the game.`);
+  }
+  /**
+   * The item's details for item.json. Browse's detail first; the caller's own
+   * item is not browsable (contract D29), so it falls back to this game's
+   * allowances, which carry everything but the description, tags and type.
+   */
+  async describe(skuId) {
+    const res = await this.game.call(`${this.game.apiUrl}/api/store/catalog/${encodeURIComponent(skuId)}`);
+    if (res.ok) {
+      const { item } = await res.json();
+      return {
+        skuId,
+        name: item.name,
+        description: item.description,
+        type: item.type,
+        tags: item.tags,
+        iconUrl: item.iconUrl,
+        modelUrl: item.modelUrl,
+        priceCoins: item.priceCoins,
+        priceDisplayUsdCents: item.priceDisplayUsdCents,
+        author: item.author,
+        homeGame: item.homeGame
+      };
+    }
+    if (res.status !== 404) {
+      await this.fail(res, "read that item");
+      return null;
+    }
+    const list = await this.game.call(this.allowances);
+    if (!list.ok) {
+      await this.fail(list, "read this game's items");
+      return null;
+    }
+    const { items } = await list.json();
+    const row = items.find((r) => r.item.id === skuId);
+    if (!row) {
+      this.refuse({ error: "sku_not_found", message: `Couldn't read ${skuId} back from this game's items.` });
+      return null;
+    }
+    return {
+      skuId,
+      name: row.item.name,
+      description: null,
+      // Only a durable can be shared (P3).
+      type: "durable",
+      tags: [],
+      iconUrl: row.item.iconUrl,
+      modelUrl: row.item.modelUrl,
+      priceCoins: row.item.priceCoins,
+      priceDisplayUsdCents: row.item.priceDisplayUsdCents,
+      author: row.item.author,
+      homeGame: row.item.homeGame
+    };
+  }
+  /** The package's signed link and its manifest, read together so the two always describe the same upload. */
+  async packageLink(skuId) {
+    const res = await this.game.call(`${this.game.apiUrl}/api/store/items/${encodeURIComponent(skuId)}/package`);
+    if (!res.ok) {
+      await this.fail(res, "fetch the item's package");
+      return null;
+    }
+    return await res.json();
+  }
+  /**
+   * Write `genex-items/<skuId>/`: download and unpack into a fresh staging
+   * folder beside it, add item.json, then swap it in — moving a previous copy
+   * under `.genex/` first. A refusal anywhere leaves the game folder as it was.
+   */
+  async writeItemFolder(skuId, itemFile, pkg) {
+    const root = process.cwd();
+    const itemsDir = path25.join(root, ITEMS_DIR);
+    await ensureRealDir(itemsDir, ITEMS_DIR);
+    const final = path25.join(itemsDir, skuId);
+    const existing = await lstatOrNull(final);
+    if (existing && !existing.isDirectory()) {
+      throw new FolderRefused(`${ITEMS_DIR}/${skuId} is a link or a file, not a folder. Move it aside first; nothing was written through it.`);
+    }
+    const keep = existing ? await replacedItemsDir(root) : null;
+    const zip = pkg ? await downloadItemPackage(pkg.url) : null;
+    const staging = path25.join(itemsDir, `.${skuId}.incoming-${crypto6.randomBytes(4).toString("hex")}`);
+    try {
+      const files = zip && pkg ? await extractItemPackage(zip, staging, pkg.manifest) : [];
+      if (!zip) await fs26.mkdir(staging);
+      await fs26.writeFile(path25.join(staging, ITEM_FILE), `${JSON.stringify(itemFile, null, 2)}
+`, { flag: "wx" });
+      if (keep) await fs26.rename(final, path25.join(keep, `${skuId}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`));
+      await fs26.rename(staging, final);
+      return files;
+    } finally {
+      await fs26.rm(staging, { recursive: true, force: true });
+    }
+  }
+  async remove(skuId) {
+    const res = await this.game.call(`${this.allowances}/${encodeURIComponent(skuId)}`, { method: "DELETE" });
+    if (!res.ok) return this.fail(res, "remove that item");
+    const body = await res.json();
+    if (this.opts.json) return this.printJson(body);
+    this.log.success(`Removed ${c.cyan(skuId)} from this game's store.`);
+    this.log.dim("  Players who own it keep it; in this game it shows as Not in this game.");
+    this.log.dim(`  ${ITEMS_DIR}/${skuId}/ is still on disk: take its code out of the game, then delete the folder.`);
+  }
+  async list() {
+    const res = await this.game.call(this.allowances);
+    if (!res.ok) return this.fail(res, "read this game's items");
+    const body = await res.json();
+    if (this.opts.json) return this.printJson(body);
+    const { log } = this;
+    if (body.items.length === 0) {
+      log.plain("This game has added no shared items.");
+      log.dim(`  Find one: ${c.cyan('genex items search "<words>"')}`);
+      return;
+    }
+    for (const { allowance, item } of body.items) {
+      const author = item.author ? ` \xB7 by ${item.author.name}` : "";
+      const live = allowance.liveFromBuildAt ? "" : c.dim(" \xB7 not live yet: it reaches the store with the next published build");
+      log.plain(`  ${c.cyan(item.id)}  ${item.name} \u2014 ${coinPrice(item.priceCoins, item.priceDisplayUsdCents)}${author}${live}`);
+    }
+  }
+};
+var FolderRefused = class extends Error {
+};
+function packageRefusal(skuId, name, err) {
+  return {
+    error: "package_invalid",
+    field: "package",
+    message: `The package was refused: ${err.message}`,
+    id: skuId,
+    hints: [
+      `${name} is added to this game, but nothing was written to ${ITEMS_DIR}/${skuId}/.`,
+      `The package is its author's to fix, not yours. Try again later: ${c.cyan(`genex items add ${skuId}`)}`,
+      "If it keeps failing, report the item as Doesn't work from its game's store, or pick another item."
+    ]
+  };
+}
+function folderRefusal(skuId, name, err) {
+  return {
+    error: ItemErrorCode.FolderRefused,
+    message: err.message,
+    id: skuId,
+    hints: [`${name} is added to this game, but nothing was written to ${ITEMS_DIR}/${skuId}/. Fix that, then run: genex items add ${skuId}`]
+  };
+}
+async function lstatOrNull(p) {
+  try {
+    return await fs26.lstat(p);
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function replacedItemsDir(root) {
+  await fs26.mkdir(path25.join(root, ".genex"), { recursive: true });
+  const keep = path25.join(root, ...REPLACED_DIR.split("/"));
+  await ensureRealDir(keep, REPLACED_DIR);
+  return keep;
+}
+async function ensureRealDir(dir, label) {
+  const stat = await lstatOrNull(dir);
+  if (!stat) {
+    await fs26.mkdir(dir);
     return;
   }
-  const res = await call2(skuUrl, { method: "DELETE" });
-  if (!res.ok) return fail5(res, "remove that item");
-  log.success("Removed from the shop.");
-  log.dim("  Players who already bought it keep it.");
+  if (!stat.isDirectory()) {
+    throw new FolderRefused(`${label} is a link or a file, not a folder. Move it aside first; nothing was written through it.`);
+  }
 }
 
 // src/lib/promote.ts
@@ -8922,6 +10158,8 @@ async function runPublish(opts) {
     process.exitCode = 1;
     return;
   }
+  const listedOnDisk = await readProject();
+  await writeProject({ ...listedOnDisk ?? meta, status: "published" });
   const listed = await res.json().catch(() => null);
   if (opts.regenerateCover && listed?.project?.coverAiEnabled === false) {
     log.dim("  --regenerate-cover did nothing: this stand doesn't make AI covers.");
@@ -9217,8 +10455,8 @@ async function runRollback(opts) {
 }
 
 // src/commands/cover.ts
-import fs24 from "fs/promises";
-import path24 from "path";
+import fs27 from "fs/promises";
+import path26 from "path";
 var WHAT_A_COVER_IS = "one real frame of the game: its signature moment, real gameplay, well lit, no menus, popups or busy HUD, landscape 16:9, no text";
 async function runCover(opts) {
   const log = createLogger({ quiet: opts.quiet || opts.json });
@@ -9243,7 +10481,7 @@ async function runCover(opts) {
   }
   let bytes;
   try {
-    const stat = await fs24.stat(file);
+    const stat = await fs27.stat(file);
     if (!stat.isFile()) throw new Error("not a file");
     if (stat.size > COVER_MAX_BYTES) {
       return finish(
@@ -9253,43 +10491,43 @@ async function runCover(opts) {
         log
       );
     }
-    bytes = await fs24.readFile(file);
+    bytes = await fs27.readFile(file);
   } catch {
     return finish({ kind: "invalid", message: `Can't read ${file} \u2014 pass the path of a PNG, JPEG or WebP image.` }, file, opts, log);
   }
-  log.step(`Uploading ${path24.basename(file)} as the cover\u2026`);
+  log.step(`Uploading ${path26.basename(file)} as the cover\u2026`);
   const outcome2 = await uploadCover({ apiUrl, token, projectId: meta.id, bytes, label: file });
   await rememberNomination(bytes, file, outcome2);
   finish(outcome2, file, opts, log);
 }
 async function rememberNomination(bytes, file, outcome2) {
   const scratch = await findScratchCover();
-  if (!scratch || path24.resolve(scratch) === path24.resolve(file)) {
+  if (!scratch || path26.resolve(scratch) === path26.resolve(file)) {
     await rememberCoverUpload(bytes, file, outcome2);
     return;
   }
   if (outcome2.kind !== "applied" && outcome2.kind !== "outranked") return;
-  const stale = await fs24.readFile(scratch).catch(() => null);
+  const stale = await fs27.readFile(scratch).catch(() => null);
   if (stale) await rememberCoverUpload(stale, scratch, outcome2);
 }
 async function sendClip(apiUrl, token, projectId, clip, opts, log) {
   const file = clip ?? "";
-  const invalid = (message) => finishClip({ kind: "invalid", message }, file, opts, log);
-  if (!clip) return invalid("--commit goes with --clip <file>: pass the recording to send.");
-  if (opts.imagePath?.trim()) return invalid("Pass either an image (the cover) or --clip <file> (the cover clip), not both.");
-  if (!opts.commit?.trim()) return invalid("--clip needs --commit <sha>: the git commit of the build the recording shows.");
+  const invalid2 = (message) => finishClip({ kind: "invalid", message }, file, opts, log);
+  if (!clip) return invalid2("--commit goes with --clip <file>: pass the recording to send.");
+  if (opts.imagePath?.trim()) return invalid2("Pass either an image (the cover) or --clip <file> (the cover clip), not both.");
+  if (!opts.commit?.trim()) return invalid2("--clip needs --commit <sha>: the git commit of the build the recording shows.");
   let bytes;
   try {
-    const stat = await fs24.stat(clip);
+    const stat = await fs27.stat(clip);
     if (!stat.isFile()) throw new Error("not a file");
     if (stat.size > CLIP_MAX_BYTES) {
-      return invalid(`${clip} is ${(stat.size / 1024 / 1024).toFixed(1)} MB; a cover clip recording can be at most ${CLIP_MAX_BYTES / 1024 / 1024} MB.`);
+      return invalid2(`${clip} is ${(stat.size / 1024 / 1024).toFixed(1)} MB; a cover clip recording can be at most ${CLIP_MAX_BYTES / 1024 / 1024} MB.`);
     }
-    bytes = await fs24.readFile(clip);
+    bytes = await fs27.readFile(clip);
   } catch {
-    return invalid(`Can't read ${clip} \u2014 pass the path of an MP4 or WebM recording.`);
+    return invalid2(`Can't read ${clip} \u2014 pass the path of an MP4 or WebM recording.`);
   }
-  log.step(`Uploading ${path24.basename(clip)} as the cover clip\u2026`);
+  log.step(`Uploading ${path26.basename(clip)} as the cover clip\u2026`);
   const outcome2 = await uploadClip({ apiUrl, token, projectId, bytes, label: clip, buildCommit: opts.commit });
   finishClip(outcome2, clip, opts, log);
 }
@@ -9347,8 +10585,8 @@ async function showCover(apiUrl, token, slug, opts, log) {
 }
 
 // src/commands/generate.ts
-import fs27 from "fs/promises";
-import path27 from "path";
+import fs30 from "fs/promises";
+import path29 from "path";
 import { PNG as PNG4 } from "pngjs";
 
 // src/lib/glass.ts
@@ -9535,13 +10773,13 @@ function ceilingVerdict(input) {
 }
 
 // src/lib/generation-admission.ts
-import fs26 from "fs/promises";
-import path26 from "path";
-import { createHash, randomUUID } from "crypto";
+import fs29 from "fs/promises";
+import path28 from "path";
+import { createHash as createHash2, randomUUID } from "crypto";
 
 // src/lib/asset-budget.ts
-import fs25 from "fs/promises";
-import path25 from "path";
+import fs28 from "fs/promises";
+import path27 from "path";
 var DEFAULT_ASSET_BUDGET_SHARE = 0.5;
 var DEFAULT_ASSET_BUDGET_CAP = 500;
 function envShare(raw, fallback) {
@@ -9568,10 +10806,10 @@ function allowanceFor(input) {
   if (!Number.isFinite(spendable) || spendable <= 0) return 0;
   return Math.max(0, Math.min(Math.floor(spendable * config.share), config.cap));
 }
-var storePath = (cwd) => path25.join(cwd, ".genex", "asset-budget.json");
+var storePath = (cwd) => path27.join(cwd, ".genex", "asset-budget.json");
 async function readBudgetStore(cwd = process.cwd()) {
   try {
-    const raw = await fs25.readFile(storePath(cwd), "utf8");
+    const raw = await fs28.readFile(storePath(cwd), "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || parsed.v !== 1 || typeof parsed.allowanceCredits !== "number" || !Number.isFinite(parsed.allowanceCredits) || parsed.setBy !== "default" && parsed.setBy !== "user") {
       return null;
@@ -9590,8 +10828,8 @@ async function readBudgetStore(cwd = process.cwd()) {
 }
 async function writeBudgetStore(cwd, store) {
   try {
-    await fs25.access(path25.join(cwd, ".genex"));
-    await fs25.writeFile(storePath(cwd), `${JSON.stringify(store, null, 2)}
+    await fs28.access(path27.join(cwd, ".genex"));
+    await fs28.writeFile(storePath(cwd), `${JSON.stringify(store, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -9602,7 +10840,7 @@ async function ensureBudgetStore(cwd, input) {
   const existing = await readBudgetStore(cwd);
   if (existing) return existing;
   try {
-    await fs25.stat(storePath(cwd));
+    await fs28.stat(storePath(cwd));
     throw new Error("Stored asset allowance is unreadable or invalid; reconcile it before paid generation.");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
@@ -9706,13 +10944,13 @@ async function assetBudgetGate(input) {
 
 // src/lib/generation-admission.ts
 async function withAdmissionLock(cwd, work, waitMs = 3e4) {
-  const lock = path26.join(cwd, ".genex", "generation-admission.lock");
-  await fs26.mkdir(path26.dirname(lock), { recursive: true });
+  const lock = path28.join(cwd, ".genex", "generation-admission.lock");
+  await fs29.mkdir(path28.dirname(lock), { recursive: true });
   const deadline = Date.now() + waitMs;
   let file;
   while (!file) {
     try {
-      file = await fs26.open(lock, "wx");
+      file = await fs29.open(lock, "wx");
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       if (Date.now() >= deadline) throw new Error("Another generation admission holds .genex/generation-admission.lock. If its process died, reconcile pending reservations before removing that lock.");
@@ -9724,7 +10962,7 @@ async function withAdmissionLock(cwd, work, waitMs = 3e4) {
     return await work();
   } finally {
     await file.close();
-    await fs26.unlink(lock);
+    await fs29.unlink(lock);
   }
 }
 async function enqueueWithAllowance(input) {
@@ -9734,7 +10972,7 @@ async function enqueueWithAllowance(input) {
       const createPath = input.createPath ?? "/api/generations";
       const generic = createPath === "/api/generations";
       const headers = { "Content-Type": "application/json", Authorization: `Bearer ${input.token}` };
-      const fingerprint = createHash("sha256").update(JSON.stringify([input.apiUrl, createPath, input.body])).digest("hex");
+      const fingerprint = createHash2("sha256").update(JSON.stringify([input.apiUrl, createPath, input.body])).digest("hex");
       const rows = await readAdmissionRows(cwd);
       const pending2 = /* @__PURE__ */ new Map();
       for (const row of rows) {
@@ -9973,7 +11211,7 @@ var isRemoteRef = (value) => /^(https?:\/\/|data:)/i.test(value);
 async function inlineLocalImage(filePath, flag) {
   let bytes;
   try {
-    bytes = await fs27.readFile(filePath);
+    bytes = await fs30.readFile(filePath);
   } catch {
     return { ok: false, error: `Couldn't read the ${flag} file at ${filePath}.` };
   }
@@ -9983,7 +11221,7 @@ async function inlineLocalImage(filePath, flag) {
       error: `${flag} file is ${(bytes.length / 1048576).toFixed(1)} MB \u2014 over the ~4 MB inline limit. Downscale/compress it first, or pass an asset URL instead.`
     };
   }
-  const mime = IMAGE_MIME_BY_EXT[path27.extname(filePath).toLowerCase()] ?? "image/png";
+  const mime = IMAGE_MIME_BY_EXT[path29.extname(filePath).toLowerCase()] ?? "image/png";
   return { ok: true, dataUri: `data:${mime};base64,${bytes.toString("base64")}` };
 }
 var SKYBOX_ENVIRONMENT_SUFFIX = ". The image contains ONLY sky: cloud, atmosphere, light, weather and distant haze at the horizon. Every structure, object, plant and ground surface is outside the frame.";
@@ -10178,7 +11416,7 @@ async function runGenerate(kind, opts) {
   let typedPrompt = opts.prompt?.trim();
   if (!typedPrompt && kind === "model" && opts.imageUrl) {
     const ref = opts.imageUrl.startsWith("data:") ? "local image" : opts.imageUrl;
-    typedPrompt = `from image: ${path27.basename(ref).slice(0, 120)}`;
+    typedPrompt = `from image: ${path29.basename(ref).slice(0, 120)}`;
   }
   if (kind === "model" && opts.texture !== void 0 && !MODEL_TEXTURE_TIERS.includes(opts.texture)) {
     log.error(`--texture ${opts.texture} is a character texture size. \`genex model\` takes a texture TIER: ${MODEL_TEXTURE_TIERS.join("|")} (default detailed).`);
@@ -10227,7 +11465,7 @@ async function runGenerate(kind, opts) {
       return;
     }
     try {
-      const bytes = await fs27.readFile(opts.inpaintUrl);
+      const bytes = await fs30.readFile(opts.inpaintUrl);
       opts = { ...opts, inpaintUrl: `data:image/png;base64,${bytes.toString("base64")}` };
     } catch {
       log.error(`Couldn't read the --inpaint mask at ${opts.inpaintUrl}.`);
@@ -10396,7 +11634,7 @@ async function reportGlassTerminal(view, outDir, log, json) {
     return;
   }
   await recordTerminal(view.id, "completed", files.map((f) => f.url));
-  await fs27.mkdir(outDir, { recursive: true });
+  await fs30.mkdir(outDir, { recursive: true });
   const solved = [];
   for (let i = 0; i < files.length; i++) {
     const f = files[i];
@@ -10428,8 +11666,8 @@ async function reportGlassTerminal(view, outDir, log, json) {
       });
       continue;
     }
-    const outPath = path27.join(outDir, `glass-${i + 1}.png`);
-    await fs27.writeFile(outPath, PNG4.sync.write(r.png));
+    const outPath = path29.join(outDir, `glass-${i + 1}.png`);
+    await fs30.writeFile(outPath, PNG4.sync.write(r.png));
     solved.push({
       path: outPath,
       url: f.url,
@@ -11059,8 +12297,8 @@ function writeJson(value) {
 }
 
 // src/commands/model-sub.ts
-import fs28 from "fs/promises";
-import path28 from "path";
+import fs31 from "fs/promises";
+import path30 from "path";
 var MODEL_SUBCOMMANDS = ["segment", "rig", "animate", "import"];
 function apiErrorMessage(data, fallback) {
   if (typeof data !== "object" || data === null) return fallback;
@@ -11075,29 +12313,29 @@ async function importModelFile(args) {
   const { log } = args;
   const filePath = args.filePath.trim();
   if (!/\.glb$/i.test(filePath)) {
-    log.error(`\`import\` takes a .glb file (binary glTF 2.0). Export ${path28.basename(filePath) || "the model"} as GLB first \u2014 Blender: File \u2192 Export \u2192 glTF 2.0, format "glTF Binary".`);
+    log.error(`\`import\` takes a .glb file (binary glTF 2.0). Export ${path30.basename(filePath) || "the model"} as GLB first \u2014 Blender: File \u2192 Export \u2192 glTF 2.0, format "glTF Binary".`);
     return null;
   }
   let bytes;
   try {
-    bytes = await fs28.readFile(filePath);
+    bytes = await fs31.readFile(filePath);
   } catch {
     log.error(`Couldn't read ${filePath}.`);
     return null;
   }
   if (bytes.byteLength > MODEL_IMPORT_MAX_BYTES) {
-    log.error(`${path28.basename(filePath)} is ${(bytes.byteLength / 1e6).toFixed(1)} MB; imports are capped at ${MODEL_IMPORT_MAX_BYTES / 1024 / 1024} MB. Shrink its textures (they are usually the bulk) and try again.`);
+    log.error(`${path30.basename(filePath)} is ${(bytes.byteLength / 1e6).toFixed(1)} MB; imports are capped at ${MODEL_IMPORT_MAX_BYTES / 1024 / 1024} MB. Shrink its textures (they are usually the bulk) and try again.`);
     return null;
   }
   if (bytes.byteLength < 12 || bytes.readUInt32LE(0) !== GLB_MAGIC) {
-    log.error(`${path28.basename(filePath)} is not a GLB (no glTF magic). A .gltf + .bin pair must be exported as one binary .glb.`);
+    log.error(`${path30.basename(filePath)} is not a GLB (no glTF magic). A .gltf + .bin pair must be exported as one binary .glb.`);
     return null;
   }
   const headers = { "Content-Type": "application/json", Authorization: `Bearer ${args.token}` };
   const minted = await apiFetch(`${args.apiUrl}/api/generations/import`, {
     method: "POST",
     headers,
-    body: JSON.stringify({ filename: path28.basename(filePath), bytes: bytes.byteLength, contentType: "model/gltf-binary" })
+    body: JSON.stringify({ filename: path30.basename(filePath), bytes: bytes.byteLength, contentType: "model/gltf-binary" })
   });
   if (printedStructuredError(minted)) return null;
   if (!minted.ok) {
@@ -11106,7 +12344,7 @@ async function importModelFile(args) {
     return null;
   }
   const { id, uploadUrl, url } = await minted.json();
-  log.dim(`  uploading ${path28.basename(filePath)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
+  log.dim(`  uploading ${path30.basename(filePath)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
   const put = await fetch(uploadUrl, {
     method: "PUT",
     headers: { "Content-Type": "model/gltf-binary", "Content-Length": String(bytes.byteLength) },
@@ -11254,7 +12492,7 @@ async function runModelAnimate(opts) {
 }
 
 // src/commands/wait.ts
-import path29 from "path";
+import path31 from "path";
 var MAX_TIMEOUT_SEC = 2e6;
 var STILL_RUNNING_EXIT = 2;
 var TERMINAL2 = /* @__PURE__ */ new Set(["completed", "failed"]);
@@ -11461,7 +12699,7 @@ async function runWaitAll(opts) {
       if (v?.status !== "completed" || !v.files?.length) continue;
       const local = localDeliveryFor("tools", { ...opts, outDir: opts.outDir ?? e.outDir }, e.prompt || e.kind);
       if (!local) continue;
-      const outDir = path29.join(path29.relative(process.cwd(), cwd) || ".", local.outDir);
+      const outDir = path31.join(path31.relative(process.cwd(), cwd) || ".", local.outDir);
       const target = { kind: e.kind, prompt: local.prompt, id: e.id, outDir };
       const missing = await undeliveredFiles(v.files, target);
       if (missing.length === 0) continue;
@@ -11573,11 +12811,11 @@ async function toRow(e, v, cwd) {
 }
 
 // src/commands/controller.ts
-import fs30 from "fs/promises";
-import path31 from "path";
+import fs33 from "fs/promises";
+import path33 from "path";
 
 // ../../packages/meshy-animation-catalog/src/index.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // ../../packages/meshy-animation-catalog/src/generated.ts
 var MESHY_ANIMATION_CATALOG = [
@@ -20295,7 +21533,7 @@ function normalizedPackDefinition(definition) {
   return { key, version: definition.version, actionIds, bindings };
 }
 function packFingerprint(definition) {
-  return createHash2("sha256").update(JSON.stringify(definition)).digest("hex");
+  return createHash3("sha256").update(JSON.stringify(definition)).digest("hex");
 }
 function createMeshyControllerPackSnapshot(definition) {
   const normalized = normalizedPackDefinition(definition);
@@ -20418,9 +21656,9 @@ function searchMeshyAnimations(query, options = {}) {
 }
 
 // src/lib/anims.ts
-import fs29 from "fs/promises";
-import path30 from "path";
-var ANIMS_DEST = path30.join("public", "assets", "anims");
+import fs32 from "fs/promises";
+import path32 from "path";
+var ANIMS_DEST = path32.join("public", "assets", "anims");
 var HIDDEN_TAG = "reference";
 async function runAnims(opts) {
   const log = createLogger({ quiet: opts.quiet });
@@ -20436,7 +21674,7 @@ async function runAnims(opts) {
     printCatalog(log, manifest, selectors);
     return;
   }
-  const controllerMarker = path30.join(root, "src", "controllers", "character");
+  const controllerMarker = path32.join(root, "src", "controllers", "character");
   if (!await exists3(controllerMarker)) {
     log.error(
       `No character controller in this game (missing ${c.cyan("src/controllers/character/")}).`
@@ -20445,11 +21683,11 @@ async function runAnims(opts) {
     process.exitCode = 1;
     return;
   }
-  const destDir = path30.join(root, ANIMS_DEST);
-  const gameManifestPath = path30.join(destDir, "manifest.json");
+  const destDir = path32.join(root, ANIMS_DEST);
+  const gameManifestPath = path32.join(destDir, "manifest.json");
   if (opts.reset) {
-    await fs29.rm(destDir, { recursive: true, force: true });
-    log.step(`Cleared ${c.cyan(ANIMS_DEST + path30.sep)} (--reset)`);
+    await fs32.rm(destDir, { recursive: true, force: true });
+    log.step(`Cleared ${c.cyan(ANIMS_DEST + path32.sep)} (--reset)`);
   }
   if (selectors.length === 0) {
     const installed = await readGameManifest(gameManifestPath);
@@ -20475,7 +21713,7 @@ async function runAnims(opts) {
     return;
   }
   const coreNames = new Set(manifest.core);
-  const byName = /* @__PURE__ */ new Map();
+  const byName2 = /* @__PURE__ */ new Map();
   let bundledSkips = 0;
   for (const entries of resolved.values()) {
     for (const entry of entries) {
@@ -20483,39 +21721,39 @@ async function runAnims(opts) {
         bundledSkips++;
         continue;
       }
-      byName.set(entry.name, entry);
+      byName2.set(entry.name, entry);
     }
   }
-  const wanted = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
-  const cacheDir = path30.join(
+  const wanted = [...byName2.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const cacheDir = path32.join(
     opts.cacheDir ?? getAnimsCacheDir(),
     `${manifest.library}-v${manifest.version}`
   );
-  await fs29.mkdir(cacheDir, { recursive: true });
-  await fs29.mkdir(destDir, { recursive: true });
+  await fs32.mkdir(cacheDir, { recursive: true });
+  await fs32.mkdir(destDir, { recursive: true });
   const base = getAnimsBase(opts.animsBase);
   let installedCount = 0;
   let presentCount = 0;
   let addedBytes = 0;
   const failures = [];
   for (const entry of wanted) {
-    const dest = path30.join(destDir, entry.file);
+    const dest = path32.join(destDir, entry.file);
     if (await hasSize(dest, entry.bytes)) {
       presentCount++;
       continue;
     }
     try {
-      const cached = path30.join(cacheDir, entry.file);
+      const cached = path32.join(cacheDir, entry.file);
       if (!await hasSize(cached, entry.bytes)) {
         const res = await fetch(base + entry.file);
         if (!res.ok) throw new Error(`HTTP ${res.status}`);
         const buf = Buffer.from(await res.arrayBuffer());
-        await fs29.writeFile(cached, buf);
+        await fs32.writeFile(cached, buf);
       }
-      await fs29.copyFile(cached, dest);
+      await fs32.copyFile(cached, dest);
       installedCount++;
       addedBytes += entry.bytes;
-      log.dim(`  ${path30.join(ANIMS_DEST, entry.file)} (${formatMb(entry.bytes)})`);
+      log.dim(`  ${path32.join(ANIMS_DEST, entry.file)} (${formatMb(entry.bytes)})`);
     } catch (err) {
       failures.push(`${entry.name} (${err instanceof Error ? err.message : String(err)})`);
     }
@@ -20531,13 +21769,13 @@ async function runAnims(opts) {
     version: manifest.version,
     clips: [...union].sort((a, b) => a.localeCompare(b))
   };
-  await fs29.writeFile(gameManifestPath, JSON.stringify(gameManifest, null, 2) + "\n");
+  await fs32.writeFile(gameManifestPath, JSON.stringify(gameManifest, null, 2) + "\n");
   log.plain("");
   const parts = [`${installedCount} clip${installedCount === 1 ? "" : "s"} installed`];
   if (presentCount > 0) parts.push(`${presentCount} already present`);
   if (bundledSkips > 0) parts.push(`${bundledSkips} already bundled in animation-library.glb`);
   log.success(
-    `${parts.join(", ")} \u2192 ${c.cyan(ANIMS_DEST + path30.sep)}${addedBytes > 0 ? ` (+${formatMb(addedBytes)})` : ""}`
+    `${parts.join(", ")} \u2192 ${c.cyan(ANIMS_DEST + path32.sep)}${addedBytes > 0 ? ` (+${formatMb(addedBytes)})` : ""}`
   );
   for (const [selector, entries] of resolved) {
     const names2 = entries.filter((e) => !coreNames.has(e.name)).map((e) => e.name);
@@ -20569,12 +21807,12 @@ async function loadManifest(baseOverride) {
     }
   } catch {
   }
-  const snapshotPath = path30.join(getTemplatesDir(), "controllers", "assets", "anims-manifest.json");
-  const manifest = JSON.parse(await fs29.readFile(snapshotPath, "utf8"));
+  const snapshotPath = path32.join(getTemplatesDir(), "controllers", "assets", "anims-manifest.json");
+  const manifest = JSON.parse(await fs32.readFile(snapshotPath, "utf8"));
   return { manifest, source: "snapshot" };
 }
 function resolveSelectors(manifest, selectors) {
-  const byName = new Map(manifest.clips.map((entry) => [entry.name, entry]));
+  const byName2 = new Map(manifest.clips.map((entry) => [entry.name, entry]));
   const byLowerName = new Map(manifest.clips.map((entry) => [entry.name.toLowerCase(), entry]));
   const tags2 = /* @__PURE__ */ new Map();
   for (const entry of manifest.clips) {
@@ -20586,7 +21824,7 @@ function resolveSelectors(manifest, selectors) {
   }
   const out = /* @__PURE__ */ new Map();
   for (const selector of selectors) {
-    const exact = byName.get(selector) ?? byLowerName.get(selector.toLowerCase());
+    const exact = byName2.get(selector) ?? byLowerName.get(selector.toLowerCase());
     if (exact) {
       out.set(selector, [exact]);
       continue;
@@ -20596,7 +21834,7 @@ function resolveSelectors(manifest, selectors) {
       out.set(selector, tagHit);
       continue;
     }
-    const candidates = [...tags2.keys(), ...byName.keys()];
+    const candidates = [...tags2.keys(), ...byName2.keys()];
     const close = suggest(selector, candidates);
     throw new Error(
       `unknown clip/tag "${selector}"${close.length > 0 ? ` \u2014 closest: ${close.join(", ")}` : ""}. Run ${c.cyan(
@@ -20688,21 +21926,21 @@ function printCatalog(log, manifest, selectors) {
 }
 async function readGameManifest(file) {
   try {
-    return JSON.parse(await fs29.readFile(file, "utf8"));
+    return JSON.parse(await fs32.readFile(file, "utf8"));
   } catch {
     return null;
   }
 }
 async function hasSize(file, bytes) {
   try {
-    return (await fs29.stat(file)).size === bytes;
+    return (await fs32.stat(file)).size === bytes;
   } catch {
     return false;
   }
 }
 async function exists3(p) {
   try {
-    await fs29.access(p);
+    await fs32.access(p);
     return true;
   } catch {
     return false;
@@ -20903,8 +22141,8 @@ var CONTROLLER_FILE_SETS = {
     ]
   }
 };
-var CODE_DEST = path31.join("src", "controllers");
-var ASSETS_DEST = path31.join("public", "assets");
+var CODE_DEST = path33.join("src", "controllers");
+var ASSETS_DEST = path33.join("public", "assets");
 async function runController(opts) {
   const log = createLogger({ quiet: opts.quiet });
   if (opts.kind?.trim() === "anims") {
@@ -20921,31 +22159,31 @@ async function runController(opts) {
     process.exitCode = 1;
     return;
   }
-  const srcDir = path31.join(getTemplatesDir(), "controllers");
+  const srcDir = path33.join(getTemplatesDir(), "controllers");
   const root = opts.cwd ?? process.cwd();
   const set = CONTROLLER_FILE_SETS[kind];
   log.plain(c.bold(`genex controller ${kind}`));
   log.plain("");
-  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path31.sep)}`);
+  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path33.sep)}`);
   const plan = [
-    ...set.code.map((rel) => ({ from: rel, rel: path31.join(CODE_DEST, rel) })),
+    ...set.code.map((rel) => ({ from: rel, rel: path33.join(CODE_DEST, rel) })),
     ...set.assets.map((rel) => ({
       from: rel,
-      rel: path31.join(ASSETS_DEST, path31.basename(rel))
+      rel: path33.join(ASSETS_DEST, path33.basename(rel))
     }))
   ];
   let copied = 0;
   let skipped = 0;
   try {
     for (const file of plan) {
-      const dest = path31.join(root, file.rel);
+      const dest = path33.join(root, file.rel);
       if (!opts.force && await exists4(dest)) {
         skipped++;
         log.dim(`  skipped ${file.rel} (exists \u2014 use --force to overwrite)`);
         continue;
       }
-      await fs30.mkdir(path31.dirname(dest), { recursive: true });
-      await fs30.copyFile(path31.join(srcDir, file.from), dest);
+      await fs33.mkdir(path33.dirname(dest), { recursive: true });
+      await fs33.copyFile(path33.join(srcDir, file.from), dest);
       copied++;
       log.dim(`  ${file.rel}`);
     }
@@ -20998,7 +22236,7 @@ async function runController(opts) {
   for (const line of set.sketch) {
     log.dim(`       ${line}`);
   }
-  if (kind === "character" && !await exists4(path31.join(root, ASSETS_DEST, "meshy-character.json"))) {
+  if (kind === "character" && !await exists4(path33.join(root, ASSETS_DEST, "meshy-character.json"))) {
     log.plain("");
     log.plain(
       `  ${stepOffset + 3}. This game has no generated character yet \u2014 ${c.cyan(
@@ -21030,9 +22268,9 @@ async function installMeshyCharacterManifest(args) {
     throw new Error("The API returned an invalid Meshy character manifest.");
   }
   assertCompleteMeshyControllerPack(manifest);
-  const destination = path31.join(args.root, ASSETS_DEST, "meshy-character.json");
-  await fs30.mkdir(path31.dirname(destination), { recursive: true });
-  await fs30.writeFile(
+  const destination = path33.join(args.root, ASSETS_DEST, "meshy-character.json");
+  await fs33.mkdir(path33.dirname(destination), { recursive: true });
+  await fs33.writeFile(
     destination,
     `${JSON.stringify(manifest, null, 2)}
 `
@@ -21177,14 +22415,14 @@ function assertCompleteMeshyControllerPack(manifest) {
 }
 async function installFallbackAvatar(args) {
   const { root, srcDir, log } = args;
-  const dest = path31.join(root, ASSETS_DEST, "avatar.vrm");
-  await fs30.mkdir(path31.dirname(dest), { recursive: true });
-  await fs30.copyFile(path31.join(srcDir, "assets", "default-avatar.vrm"), dest);
+  const dest = path33.join(root, ASSETS_DEST, "avatar.vrm");
+  await fs33.mkdir(path33.dirname(dest), { recursive: true });
+  await fs33.copyFile(path33.join(srcDir, "assets", "default-avatar.vrm"), dest);
   log.dim("  public/assets/avatar.vrm (fallback avatar \u2014 bundled CC0 default)");
 }
 async function exists4(p) {
   try {
-    await fs30.access(p);
+    await fs33.access(p);
     return true;
   } catch {
     return false;
@@ -21192,8 +22430,8 @@ async function exists4(p) {
 }
 
 // src/commands/character.ts
-import fs31 from "fs/promises";
-import path32 from "path";
+import fs34 from "fs/promises";
+import path34 from "path";
 function exactAnimation(selector) {
   const trimmed = selector.trim();
   if (/^-?\d+$/.test(trimmed)) return animationById(Number(trimmed));
@@ -21278,7 +22516,7 @@ function showAmbiguity(selector, candidates, log, json = false) {
   }
   process.exitCode = 1;
 }
-var INSTALLED_MANIFEST = path32.join("public", "assets", "meshy-character.json");
+var INSTALLED_MANIFEST = path34.join("public", "assets", "meshy-character.json");
 async function resolveAdoptTarget(selector) {
   const trimmed = selector?.trim();
   if (trimmed && !trimmed.endsWith(".json")) {
@@ -21287,7 +22525,7 @@ async function resolveAdoptTarget(selector) {
   const file = trimmed ?? INSTALLED_MANIFEST;
   let raw;
   try {
-    raw = await fs31.readFile(file, "utf8");
+    raw = await fs34.readFile(file, "utf8");
   } catch {
     return {
       ok: false,
@@ -21412,7 +22650,7 @@ async function runCharacterImport(opts) {
     opts,
     ctx,
     kind: "character",
-    prompt: `Import ${path32.basename(filePath)} as a rigged character`,
+    prompt: `Import ${path34.basename(filePath)} as a rigged character`,
     createPath: "/api/characters/import",
     body,
     quote: price,
@@ -21957,22 +23195,22 @@ async function context2(opts) {
   if (!token) return null;
   return { token, apiUrl };
 }
-async function readVideo(path47, log) {
+async function readVideo(path49, log) {
   let bytes;
   try {
-    bytes = await readFile(path47);
+    bytes = await readFile(path49);
   } catch {
-    log.error(`Can't read ${path47}.`);
+    log.error(`Can't read ${path49}.`);
     return null;
   }
   if (bytes.byteLength > MAX_VIDEO_BYTES) {
-    log.error(`${basename(path47)} is ${(bytes.byteLength / 1e6).toFixed(0)} MB \u2014 the limit is ${MAX_VIDEO_BYTES / 1e6} MB.`);
+    log.error(`${basename(path49)} is ${(bytes.byteLength / 1e6).toFixed(0)} MB \u2014 the limit is ${MAX_VIDEO_BYTES / 1e6} MB.`);
     return null;
   }
   return bytes;
 }
-async function uploadVideo(apiUrl, token, characterId, path47, bytes, log) {
-  const contentType = /\.mov$/i.test(path47) ? "video/quicktime" : "video/mp4";
+async function uploadVideo(apiUrl, token, characterId, path49, bytes, log) {
+  const contentType = /\.mov$/i.test(path49) ? "video/quicktime" : "video/mp4";
   const minted = await apiFetch(
     `${apiUrl}/api/characters/${encodeURIComponent(characterId)}/motions/video-url`,
     {
@@ -21987,7 +23225,7 @@ async function uploadVideo(apiUrl, token, characterId, path47, bytes, log) {
     return null;
   }
   const { uploadUrl, videoUrl } = await minted.json();
-  log.dim(`  uploading ${basename(path47)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
+  log.dim(`  uploading ${basename(path49)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
   const put = await fetch(uploadUrl, {
     method: "PUT",
     headers: { "Content-Type": contentType, "Content-Length": String(bytes.byteLength) },
@@ -22319,11 +23557,11 @@ function rank(items, query) {
 }
 
 // src/commands/motion.ts
-import fs32 from "fs/promises";
-import path33 from "path";
+import fs35 from "fs/promises";
+import path35 from "path";
 
 // src/lib/motion/npz.ts
-import zlib from "zlib";
+import zlib2 from "zlib";
 function decodeUcs4(b) {
   let out = "";
   for (let i = 0; i + 4 <= b.length; i += 4) {
@@ -22374,7 +23612,7 @@ function readNpz(buf) {
     const lExtraLen = buf.readUInt16LE(lho + 28);
     const dataStart = lho + 30 + lNameLen + lExtraLen;
     const raw = buf.subarray(dataStart, dataStart + csize);
-    const bytes = method === 8 ? zlib.inflateRawSync(raw) : Buffer.from(raw);
+    const bytes = method === 8 ? zlib2.inflateRawSync(raw) : Buffer.from(raw);
     if (method !== 0 && method !== 8) throw new Error(`unsupported ZIP method ${method} for ${name}`);
     out[name.replace(/\.npy$/, "")] = readNpy(bytes);
     off += 46 + nameLen + extraLen + cmtLen;
@@ -23571,7 +24809,7 @@ async function motionGen(opts, log) {
   }
   if (opts.constraintsPath !== void 0) {
     try {
-      const raw = await fs32.readFile(opts.constraintsPath, "utf8");
+      const raw = await fs35.readFile(opts.constraintsPath, "utf8");
       generationOptions.constraints = JSON.parse(raw);
     } catch {
       log.error(`Couldn't read the --constraints JSON at ${opts.constraintsPath}.`);
@@ -23595,10 +24833,10 @@ async function motionGen(opts, log) {
 async function expandTakes(selectors) {
   const out = [];
   for (const sel of selectors) {
-    const st = await fs32.stat(sel).catch(() => null);
+    const st = await fs35.stat(sel).catch(() => null);
     if (st?.isDirectory()) {
-      const names2 = await fs32.readdir(sel);
-      for (const n of names2.sort()) if (n.endsWith(".npz")) out.push(path33.join(sel, n));
+      const names2 = await fs35.readdir(sel);
+      for (const n of names2.sort()) if (n.endsWith(".npz")) out.push(path35.join(sel, n));
     } else if (st?.isFile()) {
       out.push(sel);
     } else {
@@ -23633,7 +24871,7 @@ async function motionVerify(opts, log) {
   let gates = DEFAULT_GATES;
   if (opts.gatesPath) {
     try {
-      gates = mergeGates(DEFAULT_GATES, JSON.parse(await fs32.readFile(opts.gatesPath, "utf8")));
+      gates = mergeGates(DEFAULT_GATES, JSON.parse(await fs35.readFile(opts.gatesPath, "utf8")));
     } catch {
       log.error(`Couldn't read the --gates JSON at ${opts.gatesPath}.`);
       process.exitCode = 1;
@@ -23655,9 +24893,9 @@ async function motionVerify(opts, log) {
   }
   const reports = [];
   for (const file of files) {
-    const stem = path33.basename(file).replace(/\.npz$/, "");
+    const stem = path35.basename(file).replace(/\.npz$/, "");
     try {
-      reports.push(analyzeTake(stem, await fs32.readFile(file), gates));
+      reports.push(analyzeTake(stem, await fs35.readFile(file), gates));
     } catch (err) {
       reports.push({
         take: stem,
@@ -23695,7 +24933,7 @@ async function motionCompile(opts, log) {
   let cfg = DEFAULT_MOTION_CONFIG;
   if (opts.configPath) {
     try {
-      const patch = JSON.parse(await fs32.readFile(opts.configPath, "utf8"));
+      const patch = JSON.parse(await fs35.readFile(opts.configPath, "utf8"));
       cfg = { ...DEFAULT_MOTION_CONFIG, ...patch, idleLoop: { ...DEFAULT_MOTION_CONFIG.idleLoop, ...patch.idleLoop } };
     } catch {
       log.error(`Couldn't read the --config JSON at ${opts.configPath}.`);
@@ -23713,16 +24951,16 @@ async function motionCompile(opts, log) {
   }
   const inputs = [];
   for (const file of files) {
-    const stem = path33.basename(file).replace(/\.npz$/, "");
+    const stem = path35.basename(file).replace(/\.npz$/, "");
     try {
-      inputs.push({ stem, take: loadTake(await fs32.readFile(file)) });
+      inputs.push({ stem, take: loadTake(await fs35.readFile(file)) });
     } catch (err) {
       log.error(`${stem}: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
       return;
     }
   }
-  const setName = opts.set ?? path33.basename(opts.out).replace(/\.json$/, "");
+  const setName = opts.set ?? path35.basename(opts.out).replace(/\.json$/, "");
   let result;
   try {
     result = compileSet(inputs, setName, cfg);
@@ -23737,9 +24975,9 @@ async function motionCompile(opts, log) {
     process.exitCode = 1;
     return;
   }
-  await fs32.mkdir(path33.dirname(path33.resolve(opts.out)), { recursive: true });
+  await fs35.mkdir(path35.dirname(path35.resolve(opts.out)), { recursive: true });
   const json = JSON.stringify(result.data);
-  await fs32.writeFile(opts.out, json);
+  await fs35.writeFile(opts.out, json);
   if (opts.json) {
     writeJson({ out: opts.out, set: setName, tracks: Object.keys(result.data.gaits), bytes: json.length });
     return;
@@ -23757,9 +24995,9 @@ var MOTION_RUNTIME_FILES = [
 var MOTION_PRESETS = {
   rifle: ["sets/rifle.json", "sets/jumps.json"]
 };
-var MOTION_DEST = path33.join("src", "motion");
+var MOTION_DEST = path35.join("src", "motion");
 async function motionInstall(opts, log) {
-  const srcDir = path33.join(getTemplatesDir(), "motion");
+  const srcDir = path35.join(getTemplatesDir(), "motion");
   const root = opts.cwd ?? process.cwd();
   const preset = opts.set;
   if (preset !== void 0 && !MOTION_PRESETS[preset]) {
@@ -23770,21 +25008,21 @@ async function motionInstall(opts, log) {
   const files = [...MOTION_RUNTIME_FILES, ...preset ? MOTION_PRESETS[preset] : []];
   log.plain(c.bold(`genex motion install${preset ? ` --set ${preset}` : ""}`));
   log.plain("");
-  log.step(`Vendoring the motion runtime into ${c.cyan(MOTION_DEST + path33.sep)}`);
+  log.step(`Vendoring the motion runtime into ${c.cyan(MOTION_DEST + path35.sep)}`);
   let copied = 0, skipped = 0;
   try {
     for (const rel of files) {
-      const dest = path33.join(root, MOTION_DEST, rel);
-      const exists5 = await fs32.access(dest).then(() => true, () => false);
+      const dest = path35.join(root, MOTION_DEST, rel);
+      const exists5 = await fs35.access(dest).then(() => true, () => false);
       if (!opts.force && exists5) {
         skipped++;
-        log.dim(`  skipped ${path33.join(MOTION_DEST, rel)} (exists \u2014 use --force to overwrite)`);
+        log.dim(`  skipped ${path35.join(MOTION_DEST, rel)} (exists \u2014 use --force to overwrite)`);
         continue;
       }
-      await fs32.mkdir(path33.dirname(dest), { recursive: true });
-      await fs32.copyFile(path33.join(srcDir, rel), dest);
+      await fs35.mkdir(path35.dirname(dest), { recursive: true });
+      await fs35.copyFile(path35.join(srcDir, rel), dest);
       copied++;
-      log.dim(`  ${path33.join(MOTION_DEST, rel)}`);
+      log.dim(`  ${path35.join(MOTION_DEST, rel)}`);
     }
   } catch (err) {
     log.error(`Copy failed: ${String(err)}`);
@@ -23825,7 +25063,7 @@ async function motionConstraints(opts, log) {
   }
   const doc = directionConstraint(dir, speed, duration);
   const out = opts.out ?? "constraints.json";
-  await fs32.writeFile(out, JSON.stringify(doc));
+  await fs35.writeFile(out, JSON.stringify(doc));
   if (opts.json) {
     writeJson({ out, dir: dirName, speed, duration, waypoints: doc[0].frame_indices.length });
     return;
@@ -23862,14 +25100,14 @@ async function runMotion(opts) {
 }
 
 // src/commands/blender.ts
-import fs33 from "fs/promises";
-import path34 from "path";
-var SUBS2 = ["demo", "exec", "snap", "scene", "import", "export", "reset", "mcp", "serve", "seat", "release"];
+import fs36 from "fs/promises";
+import path36 from "path";
+var SUBS3 = ["demo", "exec", "snap", "scene", "import", "export", "reset", "mcp", "serve", "seat", "release"];
 var DEFAULT_OUT_DIR = "assets/blender";
 async function writeB64(dir, name, b64) {
-  await fs33.mkdir(dir, { recursive: true });
-  const p = path34.join(dir, name);
-  await fs33.writeFile(p, Buffer.from(b64, "base64"));
+  await fs36.mkdir(dir, { recursive: true });
+  const p = path36.join(dir, name);
+  await fs36.writeFile(p, Buffer.from(b64, "base64"));
   return p;
 }
 function reportScene(log, s) {
@@ -23881,8 +25119,8 @@ function reportScene(log, s) {
 async function runBlender(opts) {
   const log = createLogger();
   const sub = opts.sub;
-  if (!sub || !SUBS2.includes(sub)) {
-    log.error(`Usage: genex blender <${SUBS2.join("|")}>`);
+  if (!sub || !SUBS3.includes(sub)) {
+    log.error(`Usage: genex blender <${SUBS3.join("|")}>`);
     return 1;
   }
   if (sub === "serve") {
@@ -23953,7 +25191,7 @@ async function runBlender(opts) {
     log.plain(rest.join("\n"));
     return 1;
   }
-  const outDir = path34.resolve(opts.outDir ?? DEFAULT_OUT_DIR);
+  const outDir = path36.resolve(opts.outDir ?? DEFAULT_OUT_DIR);
   const mode = opts.mode;
   if (mode !== void 0 && !isRenderMode(mode)) {
     log.error(`Unknown --mode ${mode}. Use one of: ${RENDER_MODES.join(", ")}.`);
@@ -23993,14 +25231,14 @@ async function runBlender(opts) {
       return 0;
     }
     case "export": {
-      const target = opts.out ?? path34.join(outDir, "scene.glb");
+      const target = opts.out ?? path36.join(outDir, "scene.glb");
       const r = await blenderCall(base, "/export", { path: "/tmp/genex-export.glb" });
       if (!r.glbBase64) {
         log.error(`/export answered with no GLB bytes${r.uploaded ? " (it was uploaded, not inlined)" : ""}`);
         return 1;
       }
-      await fs33.mkdir(path34.dirname(target), { recursive: true });
-      await fs33.writeFile(target, Buffer.from(r.glbBase64, "base64"));
+      await fs36.mkdir(path36.dirname(target), { recursive: true });
+      await fs36.writeFile(target, Buffer.from(r.glbBase64, "base64"));
       log.success(`Exported ${r.bytes ?? 0} bytes`);
       log.plain(`  ${c.cyan(target)}`);
       return 0;
@@ -24033,12 +25271,12 @@ async function runBlender(opts) {
           return 1;
         }
         try {
-          script = await fs33.readFile(opts.input, "utf8");
+          script = await fs36.readFile(opts.input, "utf8");
         } catch {
           log.error(`Can't read ${opts.input}`);
           return 1;
         }
-        label = path34.basename(opts.input);
+        label = path36.basename(opts.input);
       }
       const r = await blenderCall(base, "/exec", { script, ...mode ? { mode } : {}, sheet: { formats: SHEET_FORMATS } });
       if (r.stdout?.trim()) log.plain(r.stdout.trimEnd());
@@ -24157,9 +25395,9 @@ print(f"castle: {n} objects")
 `;
 
 // src/commands/asset-new.ts
-import fs34 from "fs";
+import fs37 from "fs";
 import fsp from "fs/promises";
-import path35 from "path";
+import path37 from "path";
 import { pathToFileURL } from "url";
 var EXTRA_FILES = [
   "genex-asset.example.json",
@@ -24253,7 +25491,7 @@ Every milestone ends with \`npm run verify\`, then \`npx genex preview --no-buil
 }
 async function runAssetNew(options) {
   const log = createLogger();
-  const cwd = options.dir ? path35.resolve(options.dir) : process.cwd();
+  const cwd = options.dir ? path37.resolve(options.dir) : process.cwd();
   const slug = options.assetSlug;
   if (!slug) {
     log.error('Usage: genex asset new <slug> [--title "<Name>"] [--dims WxDxH] [--tri-band LOW-HIGH] [--holder "<your name>"] [--out <dir>]');
@@ -24263,14 +25501,14 @@ async function runAssetNew(options) {
     log.error(`The slug must be kebab-case (letters, digits, dashes), got: ${slug}`);
     return 1;
   }
-  const templateDir = path35.join(getTemplatesDir(), "asset-viewer");
-  if (!fs34.existsSync(templateDir)) {
+  const templateDir = path37.join(getTemplatesDir(), "asset-viewer");
+  if (!fs37.existsSync(templateDir)) {
     log.error(`Vendored asset-viewer template not found at ${templateDir} \u2014 reinstall the CLI.`);
     return 1;
   }
-  const manifestTools = await import(pathToFileURL(path35.join(templateDir, "tools", "emit-manifest.mjs")).href);
+  const manifestTools = await import(pathToFileURL(path37.join(templateDir, "tools", "emit-manifest.mjs")).href);
   const { SHARED_FILES, PARITY_FILENAME, hashSharedFiles, pascalCase } = manifestTools;
-  const lockPath = path35.join(templateDir, "shared-files.sha256.json");
+  const lockPath = path37.join(templateDir, "shared-files.sha256.json");
   const lock = JSON.parse(await fsp.readFile(lockPath, "utf8"));
   const actual = hashSharedFiles(templateDir);
   const drifted = SHARED_FILES.filter((rel) => lock.files[rel] !== actual[rel]);
@@ -24283,8 +25521,8 @@ async function runAssetNew(options) {
   const triBand = parseBand(options.triBand ?? "500-8000");
   const holder = options.holder?.trim() || HOLDER_PLACEHOLDER;
   const year = (/* @__PURE__ */ new Date()).getUTCFullYear();
-  const outDir = path35.resolve(cwd, options.out ?? slug);
-  if (fs34.existsSync(outDir) && fs34.readdirSync(outDir).length > 0 && !options.force) {
+  const outDir = path37.resolve(cwd, options.out ?? slug);
+  if (fs37.existsSync(outDir) && fs37.readdirSync(outDir).length > 0 && !options.force) {
     log.error(`${outDir} already holds files. Nothing was touched \u2014 pass --force to write into it anyway.`);
     return 1;
   }
@@ -24312,24 +25550,24 @@ async function runAssetNew(options) {
   };
   await fsp.mkdir(outDir, { recursive: true });
   for (const rel of [...SHARED_FILES, ...EXTRA_FILES]) {
-    const to = path35.join(outDir, rel);
-    await fsp.mkdir(path35.dirname(to), { recursive: true });
-    await fsp.copyFile(path35.join(templateDir, rel), to);
+    const to = path37.join(outDir, rel);
+    await fsp.mkdir(path37.dirname(to), { recursive: true });
+    await fsp.copyFile(path37.join(templateDir, rel), to);
   }
-  const pkg = fillTemplate(await fsp.readFile(path35.join(templateDir, "package.json"), "utf8"), {
+  const pkg = fillTemplate(await fsp.readFile(path37.join(templateDir, "package.json"), "utf8"), {
     slug,
     name,
     version
   });
-  await fsp.writeFile(path35.join(outDir, "package.json"), pkg, "utf8");
-  await fsp.writeFile(path35.join(outDir, "asset.config.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
-  await fsp.writeFile(path35.join(outDir, ".gitignore"), GITIGNORE, "utf8");
+  await fsp.writeFile(path37.join(outDir, "package.json"), pkg, "utf8");
+  await fsp.writeFile(path37.join(outDir, "asset.config.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
+  await fsp.writeFile(path37.join(outDir, ".gitignore"), GITIGNORE, "utf8");
   await fsp.writeFile(
-    path35.join(outDir, "DESIGN.md"),
+    path37.join(outDir, "DESIGN.md"),
     designDoc({ name, slug, sizeMeters, triBand, holder }),
     "utf8"
   );
-  const placeholder = await fsp.readFile(path35.join(templateDir, "src", "asset", "PLACEHOLDER.ts"), "utf8");
+  const placeholder = await fsp.readFile(path37.join(templateDir, "src", "asset", "PLACEHOLDER.ts"), "utf8");
   const seeded = seedAssetSource(placeholder, {
     slug,
     name,
@@ -24340,8 +25578,8 @@ async function runAssetNew(options) {
     pascalCase
   });
   const assetFilename = `${slug.replace(/-([a-z0-9])/g, (_, ch) => ch.toUpperCase())}.ts`;
-  await fsp.mkdir(path35.join(outDir, "src", "asset"), { recursive: true });
-  await fsp.writeFile(path35.join(outDir, "src", "asset", assetFilename), seeded, "utf8");
+  await fsp.mkdir(path37.join(outDir, "src", "asset"), { recursive: true });
+  await fsp.writeFile(path37.join(outDir, "src", "asset", assetFilename), seeded, "utf8");
   const copied = hashSharedFiles(outDir);
   const mismatched = SHARED_FILES.filter((rel) => copied[rel] !== lock.files[rel]);
   if (mismatched.length) {
@@ -24349,7 +25587,7 @@ async function runAssetNew(options) {
     return 1;
   }
   await fsp.writeFile(
-    path35.join(outDir, PARITY_FILENAME),
+    path37.join(outDir, PARITY_FILENAME),
     JSON.stringify(
       {
         note: "Recorded by `genex asset new`. Gate G13 recomputes these; do not hand-edit the viewer.",
@@ -24393,16 +25631,16 @@ async function runAssetNew(options) {
 }
 
 // src/commands/tools.ts
-import path38 from "path";
+import path40 from "path";
 
 // src/commands/doctor.ts
-import path37 from "path";
+import path39 from "path";
 
 // src/commands/llm.ts
-import fs35 from "fs/promises";
-import path36 from "path";
+import fs38 from "fs/promises";
+import path38 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-var SUBS3 = ["models", "bench", "price", "status", "cancel"];
+var SUBS4 = ["models", "bench", "price", "status", "cancel"];
 var LLM_BENCH_APPROVAL_REQUIRED = "STOP: `genex llm bench` runs the real model and spends YOUR OWN credits \u2014 your balance, not a player's, and a spend this build's asset allowance does not count. Re-run with --max-credits <n> --user-approved only after the person at the keyboard agreed to the number.";
 var LLM_MAX_COINS_DEPRECATED = "--max-coins is deprecated: it is read as --max-credits, the same number \u2014 a bench spends credits now.";
 function benchBalanceShortLine(spendable, maxCredits) {
@@ -24548,8 +25786,8 @@ async function runLlm(opts = {}) {
     else log.error(message);
     process.exitCode = 1;
   };
-  if (!SUBS3.includes(sub)) {
-    fail5(`llm ${sub}`, `Unknown subcommand ${sub}. Use: ${SUBS3.join(", ")}.`);
+  if (!SUBS4.includes(sub)) {
+    fail5(`llm ${sub}`, `Unknown subcommand ${sub}. Use: ${SUBS4.join(", ")}.`);
     return;
   }
   if (sub === "price") {
@@ -24921,7 +26159,7 @@ async function runBench(args) {
   let schema;
   if (opts.schemaPath) {
     try {
-      schema = JSON.parse(await fs35.readFile(path36.resolve(cwd, opts.schemaPath), "utf8"));
+      schema = JSON.parse(await fs38.readFile(path38.resolve(cwd, opts.schemaPath), "utf8"));
     } catch (err) {
       benchFailed(opts, log, `Couldn't read --schema ${opts.schemaPath}: ${err instanceof Error ? err.message : String(err)}`);
       return;
@@ -25303,9 +26541,9 @@ async function pollSettled(call2, url, timeoutSec) {
 }
 async function saveBench(cwd, record) {
   try {
-    const file = path36.join(cwd, LLM_BENCH_FILE);
-    await fs35.mkdir(path36.dirname(file), { recursive: true });
-    await fs35.writeFile(file, JSON.stringify(record, null, 2) + "\n");
+    const file = path38.join(cwd, LLM_BENCH_FILE);
+    await fs38.mkdir(path38.dirname(file), { recursive: true });
+    await fs38.writeFile(file, JSON.stringify(record, null, 2) + "\n");
     return LLM_BENCH_FILE;
   } catch {
     return null;
@@ -25412,8 +26650,8 @@ async function reportStatus(args) {
     for (const row of rows) {
       const state = rowState(row);
       const mark = state === "active" ? c.cyan("\u25CF") : state === "awaiting bill" ? c.yellow("\u25D0") : c.green("\u25CB");
-      const money2 = rowMoney(row);
-      const reserved = money2.reserved === null ? "reserved \u2014" : `${money2.reserved} ${money2.unit} reserved`;
+      const money = rowMoney(row);
+      const reserved = money.reserved === null ? "reserved \u2014" : `${money.reserved} ${money.unit} reserved`;
       log.plain(
         `  ${mark} ${row.id ?? "?"}  ${row.modelId ?? "?"}  ${state.padEnd(13)}  ${formatAge(row.createdAt, now).padStart(4)} old  ${reserved}${row.error ? `  ${row.error}` : ""}${rowHoldsSlot(row) ? "" : c.dim("  (no slot)")}`
       );
@@ -25488,8 +26726,8 @@ async function cancelCall(args) {
         log.dim(`  Nothing to cancel: what it reserved releases when the bill resolves, and it stops holding a slot ${PENDING_SLOT_RELEASE_MINUTES} minutes after dispatch.`);
         if (row.providerMessage?.trim()) log.dim(`  Provider said: ${row.providerMessage.trim()}`);
       } else {
-        const money2 = rowMoney(row);
-        log.dim(`  ${money2.charged === null ? "charge unknown" : `${money2.charged} ${money2.unit} charged`}${row.error ? ` \xB7 ${row.error}` : ""}.`);
+        const money = rowMoney(row);
+        log.dim(`  ${money.charged === null ? "charge unknown" : `${money.charged} ${money.unit} charged`}${row.error ? ` \xB7 ${row.error}` : ""}.`);
       }
     }
     return done("ok", null, state === "awaiting bill" ? "awaiting_bill" : "already_final", row);
@@ -25518,7 +26756,7 @@ async function cancelCall(args) {
 async function readSavedBench(cwd) {
   let parsed;
   try {
-    parsed = JSON.parse(await fs35.readFile(path36.join(cwd, LLM_BENCH_FILE), "utf8"));
+    parsed = JSON.parse(await fs38.readFile(path38.join(cwd, LLM_BENCH_FILE), "utf8"));
   } catch {
     return null;
   }
@@ -25950,7 +27188,7 @@ async function fetchLegalStatus(apiUrl, token) {
 }
 async function firstSkillsMarker() {
   for (const target of resolveAgentTargets()) {
-    const marker = await readSkillsMarker(path37.join(target.baseDir, "skills"));
+    const marker = await readSkillsMarker(path39.join(target.baseDir, "skills"));
     if (marker) return marker;
   }
   return null;
@@ -26002,11 +27240,11 @@ async function runTools(opts) {
   let totalUpdated = 0;
   const refused = [];
   for (const t of targets) {
-    const dest = path38.join(t.baseDir, "skills");
+    const dest = path40.join(t.baseDir, "skills");
     let copied;
     let updated;
     try {
-      ({ copied, updated } = await copyTemplates(path38.join(templatesDir, "skills"), dest, {
+      ({ copied, updated } = await copyTemplates(path40.join(templatesDir, "skills"), dest, {
         filter: (rel) => skillFamilyFilter("tools")(`skills/${rel}`)
       }));
       await pruneRemovedSkills(dest, log);
@@ -26078,8 +27316,8 @@ async function runTools(opts) {
 }
 
 // src/commands/budget.ts
-import fs36 from "fs/promises";
-import path39 from "path";
+import fs39 from "fs/promises";
+import path41 from "path";
 var BUDGET_SOURCE_LINE = "Live from your account; prices can change without a deploy.";
 var BUDGET_APPROVAL_REQUIRED = "STOP: raising the asset allowance requires the player's explicit approval. Re-run with --user-approved only after they agreed to the number.";
 function internalKind(kind) {
@@ -26087,7 +27325,7 @@ function internalKind(kind) {
 }
 async function isGenexProject(cwd) {
   try {
-    await fs36.access(path39.join(cwd, ".genex"));
+    await fs39.access(path41.join(cwd, ".genex"));
     return true;
   } catch {
     return false;
@@ -26236,39 +27474,39 @@ async function runBudget(opts = {}) {
 }
 
 // src/commands/player.ts
-import fs41 from "fs";
+import fs44 from "fs";
 import fsp2 from "fs/promises";
 import os12 from "os";
-import path45 from "path";
+import path47 from "path";
 import { spawn as spawn8 } from "child_process";
 
 // src/lib/player/paths.ts
 import os8 from "os";
-import path40 from "path";
+import path42 from "path";
 var PLAYER_DRY_RUN_ENV = "GENEX_PLAYER_DRY_RUN";
 function playerDryRun() {
   const raw = process.env[PLAYER_DRY_RUN_ENV];
   return raw === "1" || raw === "true";
 }
 function playerPaths(home = os8.homedir()) {
-  const dir = home === os8.homedir() ? getGenexDir() : path40.join(home, ".genex");
-  const logDir = path40.join(dir, "logs");
+  const dir = home === os8.homedir() ? getGenexDir() : path42.join(home, ".genex");
+  const logDir = path42.join(dir, "logs");
   return {
-    credential: path40.join(dir, "player.json"),
-    state: path40.join(dir, "player-state.json"),
-    relaunch: path40.join(dir, "player-relaunch.json"),
+    credential: path42.join(dir, "player.json"),
+    state: path42.join(dir, "player-state.json"),
+    relaunch: path42.join(dir, "player-relaunch.json"),
     logDir,
-    log: path40.join(logDir, "player.log"),
-    errorLog: path40.join(logDir, "player.error.log")
+    log: path42.join(logDir, "player.log"),
+    errorLog: path42.join(logDir, "player.error.log")
   };
 }
 
 // src/lib/player/store.ts
-import fs37 from "fs/promises";
-import path41 from "path";
+import fs40 from "fs/promises";
+import path43 from "path";
 async function readPlayerInstall(home) {
   try {
-    const raw = await fs37.readFile(playerPaths(home).credential, "utf8");
+    const raw = await fs40.readFile(playerPaths(home).credential, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed.token !== "string" || typeof parsed.apiUrl !== "string") return null;
     return parsed;
@@ -26298,7 +27536,7 @@ function describeInstall(install2) {
 }
 async function readPlayerState(home) {
   try {
-    return JSON.parse(await fs37.readFile(playerPaths(home).state, "utf8"));
+    return JSON.parse(await fs40.readFile(playerPaths(home).state, "utf8"));
   } catch {
     return null;
   }
@@ -26306,8 +27544,8 @@ async function readPlayerState(home) {
 async function writePlayerState(state, home) {
   const file = playerPaths(home).state;
   try {
-    await fs37.mkdir(path41.dirname(file), { recursive: true, mode: 448 });
-    await fs37.writeFile(file, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
+    await fs40.mkdir(path43.dirname(file), { recursive: true, mode: 448 });
+    await fs40.writeFile(file, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
   } catch {
   }
 }
@@ -26315,8 +27553,8 @@ async function removePlayerFiles(home) {
   const paths = playerPaths(home);
   const removed = [];
   for (const file of [paths.credential, paths.state, paths.relaunch]) {
-    const existed = await fs37.stat(file).then(() => true, () => false);
-    await fs37.rm(file, { force: true }).catch(() => {
+    const existed = await fs40.stat(file).then(() => true, () => false);
+    await fs40.rm(file, { force: true }).catch(() => {
     });
     if (existed) removed.push(file);
   }
@@ -26450,14 +27688,14 @@ var PlayerClient = class {
     this.version = options.version ?? getCliVersion();
     this.timeoutMs = options.timeoutMs ?? 3e4;
   }
-  async call(path47, init = {}, provider) {
+  async call(path49, init = {}, provider) {
     const headers = {
       Authorization: `Bearer ${this.token}`,
       [PLAYER_VERSION_HEADER]: this.version,
       ...provider ? { [EXTERNAL_PROVIDER_HEADER]: provider } : {},
       ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
     };
-    const res = await apiFetch(`${this.apiUrl}${path47}`, {
+    const res = await apiFetch(`${this.apiUrl}${path49}`, {
       ...init,
       headers,
       signal: AbortSignal.timeout(this.timeoutMs)
@@ -26526,10 +27764,10 @@ var PlayerClient = class {
 
 // src/lib/player/runners.ts
 import { spawn as spawn6, spawnSync } from "child_process";
-import fs38 from "fs/promises";
+import fs41 from "fs/promises";
 import fsSync from "fs";
 import os9 from "os";
-import path42 from "path";
+import path44 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 var WATCHER_RUNNERS = ["claude", "codex"];
 var RUNNER_FOR_FAMILY = { claude: "claude", chatgpt: "codex" };
@@ -26587,7 +27825,7 @@ function resolveOnPath(name, env = process.env, platform = process.platform) {
   const candidates = win ? [`${name}.cmd`, `${name}.exe`, `${name}.bat`, name] : [name];
   for (const dir of dirs) {
     for (const candidate of candidates) {
-      const file = path42.join(dir, candidate);
+      const file = path44.join(dir, candidate);
       try {
         const stat = fsSync.statSync(file);
         if (!stat.isFile()) continue;
@@ -26751,17 +27989,17 @@ async function runJob(job, options = {}) {
   if (!resolved) {
     return { ok: false, release: "runner_unavailable", detail: `missing:${runner}`, durationMs: Date.now() - started };
   }
-  const cwd = path42.join(os9.tmpdir(), `genex-player-${randomUUID3()}`);
-  await fs38.mkdir(cwd, { recursive: true, mode: 448 });
-  const outFile = path42.join(cwd, "result.out");
+  const cwd = path44.join(os9.tmpdir(), `genex-player-${randomUUID3()}`);
+  await fs41.mkdir(cwd, { recursive: true, mode: 448 });
+  const outFile = path44.join(cwd, "result.out");
   let argv;
   if (runner === "claude") {
     argv = claudeArgv(job, policy.claude ?? FALLBACK_POLICY.claude ?? {});
   } else {
     let schemaFile;
     if (job.outputFormat === "json" && job.schema !== void 0) {
-      schemaFile = path42.join(cwd, "schema.json");
-      await fs38.writeFile(schemaFile, JSON.stringify(job.schema), { mode: 384 });
+      schemaFile = path44.join(cwd, "schema.json");
+      await fs41.writeFile(schemaFile, JSON.stringify(job.schema), { mode: 384 });
     }
     argv = codexArgv(job, policy.codex ?? FALLBACK_POLICY.codex ?? {}, { cwd, outFile, ...schemaFile ? { schemaFile } : {} });
   }
@@ -26825,7 +28063,7 @@ async function runJob(job, options = {}) {
       if (!read2.ok) return { ok: false, release: "failed", detail: read2.detail, exitCode: code, durationMs };
       return { ok: true, output: read2.output, exitCode: code, durationMs };
     }
-    const text = await fs38.readFile(outFile, "utf8").catch(() => "");
+    const text = await fs41.readFile(outFile, "utf8").catch(() => "");
     if (code !== 0 && !text.trim()) {
       const classified = classifyFailure(`${stderrText} exit ${code}`);
       return { ok: false, ...classified, detail: `exit_${code}`, exitCode: code, durationMs };
@@ -26834,15 +28072,15 @@ async function runJob(job, options = {}) {
     if (!read.ok) return { ok: false, release: "failed", detail: read.detail, exitCode: code, durationMs };
     return { ok: true, output: read.output, exitCode: code, durationMs };
   } finally {
-    await fs38.rm(cwd, { recursive: true, force: true }).catch(() => {
+    await fs41.rm(cwd, { recursive: true, force: true }).catch(() => {
     });
   }
 }
 
 // src/lib/player/service.ts
-import fs39 from "fs/promises";
+import fs42 from "fs/promises";
 import os10 from "os";
-import path43 from "path";
+import path45 from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 var run2 = promisify(execFile);
@@ -26859,9 +28097,9 @@ function servicePlatform(platform = process.platform) {
 }
 function servicePaths(platform, home = os10.homedir()) {
   const { log, errorLog } = playerPaths(home);
-  if (platform === "darwin") return { log, errorLog, unit: path43.join(home, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`) };
-  if (platform === "linux") return { log, errorLog, unit: path43.join(home, ".config", "systemd", "user", SYSTEMD_UNIT) };
-  return { log, errorLog, unit: path43.join(home, "AppData", "Roaming", "Microsoft", "Windows", "Start Menu", "Programs", "Startup", "genex-player.cmd") };
+  if (platform === "darwin") return { log, errorLog, unit: path45.join(home, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`) };
+  if (platform === "linux") return { log, errorLog, unit: path45.join(home, ".config", "systemd", "user", SYSTEMD_UNIT) };
+  return { log, errorLog, unit: path45.join(home, "AppData", "Roaming", "Microsoft", "Windows", "Start Menu", "Programs", "Startup", "genex-player.cmd") };
 }
 function xmlEscape(value) {
   return value.replace(/[<>&'"]/g, (ch) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", "'": "&apos;", '"': "&quot;" })[ch]);
@@ -26940,9 +28178,9 @@ function autostartCommand(opts) {
 }
 async function installService(input, platform = servicePlatform()) {
   const paths = servicePaths(platform, input.home);
-  await fs39.mkdir(path43.dirname(paths.unit), { recursive: true });
-  await fs39.mkdir(path43.dirname(paths.log), { recursive: true, mode: 448 });
-  await fs39.writeFile(paths.unit, unitFile(platform, input, paths), { mode: platform === "win32" ? 420 : 384 });
+  await fs42.mkdir(path45.dirname(paths.unit), { recursive: true });
+  await fs42.mkdir(path45.dirname(paths.log), { recursive: true, mode: 448 });
+  await fs42.writeFile(paths.unit, unitFile(platform, input, paths), { mode: platform === "win32" ? 420 : 384 });
   if (playerDryRun()) return { unit: paths.unit, loaded: false, detail: "dry run \u2014 the unit was written, the system was not asked" };
   if (platform === "darwin") {
     const domain = `gui/${process.getuid?.() ?? 501}`;
@@ -26971,7 +28209,7 @@ async function installService(input, platform = servicePlatform()) {
 }
 async function serviceInstalled(home = os10.homedir(), platform = servicePlatform()) {
   const paths = servicePaths(platform, home);
-  return await fs39.stat(paths.unit).then(() => paths.unit, () => null);
+  return await fs42.stat(paths.unit).then(() => paths.unit, () => null);
 }
 async function stopService(home = os10.homedir(), platform = servicePlatform()) {
   const paths = servicePaths(platform, home);
@@ -27001,15 +28239,15 @@ async function uninstallService(home = os10.homedir(), platform = servicePlatfor
       });
     }
   }
-  await fs39.rm(paths.unit, { force: true }).catch(() => {
+  await fs42.rm(paths.unit, { force: true }).catch(() => {
   });
   return { unit: paths.unit, loaded: false, detail: present ? "removed" : "nothing installed" };
 }
 
 // src/lib/player/relaunch.ts
-import fs40 from "fs/promises";
+import fs43 from "fs/promises";
 import fsSync2 from "fs";
-import path44 from "path";
+import path46 from "path";
 import { spawn as spawn7 } from "child_process";
 var RELAUNCH_COOLDOWN_MS = 10 * 60 * 1e3;
 function relaunchPlan(input) {
@@ -27037,7 +28275,7 @@ function relaunchPossible() {
 }
 async function relaunchOnCooldown(home, now = Date.now()) {
   try {
-    const raw = await fs40.readFile(playerPaths(home).relaunch, "utf8");
+    const raw = await fs43.readFile(playerPaths(home).relaunch, "utf8");
     const at = Date.parse(JSON.parse(raw).at ?? "");
     return Number.isFinite(at) && now - at < RELAUNCH_COOLDOWN_MS;
   } catch {
@@ -27047,8 +28285,8 @@ async function relaunchOnCooldown(home, now = Date.now()) {
 async function markRelaunch(version, home) {
   const file = playerPaths(home).relaunch;
   try {
-    await fs40.mkdir(path44.dirname(file), { recursive: true, mode: 448 });
-    await fs40.writeFile(file, JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), version }) + "\n", { mode: 384 });
+    await fs43.mkdir(path46.dirname(file), { recursive: true, mode: 448 });
+    await fs43.writeFile(file, JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), version }) + "\n", { mode: 384 });
   } catch {
   }
 }
@@ -27072,7 +28310,7 @@ async function relaunchWatcher(input) {
   let err;
   const paths = playerPaths(input.home);
   try {
-    await fs40.mkdir(paths.logDir, { recursive: true, mode: 448 });
+    await fs43.mkdir(paths.logDir, { recursive: true, mode: 448 });
     out = fsSync2.openSync(paths.log, "a", 384);
     err = fsSync2.openSync(paths.errorLog, "a", 384);
   } catch {
@@ -27410,15 +28648,15 @@ function defaultLabel2() {
 }
 
 // src/commands/player.ts
-var SUBS4 = ["install", "run", "status", "stop", "uninstall"];
+var SUBS5 = ["install", "run", "status", "stop", "uninstall"];
 var PLAYER_NOT_INSTALLED = "This machine is not set up to answer in-game model requests \u2014 run `genex player install` first.";
 var PLAYER_REAUTH_REQUIRED = "Genex no longer accepts this machine's approval \u2014 run `genex player install` again.";
 var PLAYER_NO_RUNNERS = "Neither `claude` nor `codex` is on this machine's PATH, so nothing can be answered yet. Install the one whose subscription you pay for, sign into it, and this watcher picks it up on its own.";
 async function runPlayer(opts = {}) {
   const log = createLogger({ quiet: opts.quiet || opts.json });
   const sub = opts.name?.trim() || "status";
-  if (!SUBS4.includes(sub)) {
-    fail4(opts, log, `player ${sub}`, `Unknown subcommand ${sub}. Use: ${SUBS4.join(", ")}.`);
+  if (!SUBS5.includes(sub)) {
+    fail4(opts, log, `player ${sub}`, `Unknown subcommand ${sub}. Use: ${SUBS5.join(", ")}.`);
     return;
   }
   if (opts.dryRun) process.env[PLAYER_DRY_RUN_ENV] = "1";
@@ -27553,8 +28791,8 @@ async function spawnDetachedRun(apiUrl, opts) {
   try {
     const paths = playerPaths();
     await fsp2.mkdir(paths.logDir, { recursive: true, mode: 448 });
-    out = fs41.openSync(paths.log, "a", 384);
-    err = fs41.openSync(paths.errorLog, "a", 384);
+    out = fs44.openSync(paths.log, "a", 384);
+    err = fs44.openSync(paths.errorLog, "a", 384);
     const args = [process.argv[1] ?? "", "player", "run", ...opts.apiUrl ? ["--api-url", apiUrl] : []];
     const child = spawn8(process.execPath, args, { detached: true, stdio: ["ignore", out, err] });
     child.on("error", () => {
@@ -27565,7 +28803,7 @@ async function spawnDetachedRun(apiUrl, opts) {
     return false;
   } finally {
     for (const fd of [out, err]) if (fd !== void 0) try {
-      fs41.closeSync(fd);
+      fs44.closeSync(fd);
     } catch {
     }
   }
@@ -27764,7 +29002,7 @@ async function uninstall(opts, log) {
     writeJsonLine2({ command: "player uninstall", status: "ok", error: null, unit: service.unit, detail: service.detail, removed });
     return;
   }
-  log.success(`Removed: ${service.detail} (${path45.basename(service.unit)})`);
+  log.success(`Removed: ${service.detail} (${path47.basename(service.unit)})`);
   for (const file of removed) log.dim(`  deleted ${file}`);
   if (removed.length === 0) log.dim("  no credential was stored here");
   log.plain("");
@@ -27782,46 +29020,46 @@ function writeJsonLine2(value) {
 }
 
 // src/lib/native-build.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { createReadStream } from "fs";
-import fs43 from "fs/promises";
+import fs46 from "fs/promises";
 import os13 from "os";
-import path46 from "path";
+import path48 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 
 // src/lib/native-zip.ts
-import fs42 from "fs/promises";
-import zlib2 from "zlib";
-var EOCD_SIGNATURE = 101010256;
+import fs45 from "fs/promises";
+import zlib3 from "zlib";
+var EOCD_SIGNATURE2 = 101010256;
 var EOCD64_LOCATOR_SIGNATURE = 117853008;
 var EOCD64_SIGNATURE = 101075792;
-var CENTRAL_SIGNATURE = 33639248;
-var LOCAL_SIGNATURE = 67324752;
+var CENTRAL_SIGNATURE2 = 33639248;
+var LOCAL_SIGNATURE2 = 67324752;
 var EOCD_MIN = 22;
-var COMMENT_MAX = 65535;
+var COMMENT_MAX2 = 65535;
 var ZIP64_EXTRA = 1;
 var U32_MAX = 4294967295;
 var U16_MAX = 65535;
 var DIRECTORY_MAX_BYTES = 256 * 1024 * 1024;
-var UNIX_HOST = 3;
+var UNIX_HOST2 = 3;
 var INPUT_MIN = 64 * 1024;
 var INPUT_MAX = 1024 * 1024;
-var S_IFMT = 61440;
+var S_IFMT2 = 61440;
 var S_IFLNK = 40960;
 var isDirectory = (entry) => entry.name.endsWith("/");
-var isSymlink = (entry) => entry.mode !== null && (entry.mode & S_IFMT) === S_IFLNK;
+var isSymlink = (entry) => entry.mode !== null && (entry.mode & S_IFMT2) === S_IFLNK;
 async function readAt2(file, position, length) {
   const buffer = Buffer.alloc(length);
   const { bytesRead } = await file.read(buffer, 0, length, position);
   return buffer.subarray(0, bytesRead);
 }
-async function findDirectory(file, size) {
-  const tailLength = Math.min(size, EOCD_MIN + COMMENT_MAX);
+async function findDirectory2(file, size) {
+  const tailLength = Math.min(size, EOCD_MIN + COMMENT_MAX2);
   const tail = await readAt2(file, size - tailLength, tailLength);
   let at = -1;
   for (let i = tail.length - EOCD_MIN; i >= 0; i--) {
-    if (tail.readUInt32LE(i) === EOCD_SIGNATURE) {
+    if (tail.readUInt32LE(i) === EOCD_SIGNATURE2) {
       at = i;
       break;
     }
@@ -27863,15 +29101,15 @@ function applyZip64(extra, entry, overflowed) {
   }
 }
 async function readZipEntries(filePath) {
-  const file = await fs42.open(filePath, "r");
+  const file = await fs45.open(filePath, "r");
   try {
     const { size } = await file.stat();
-    const directory = await findDirectory(file, size);
+    const directory = await findDirectory2(file, size);
     const data = await readAt2(file, directory.offset, directory.bytes);
     const entries = [];
     let at = 0;
     while (entries.length < directory.count && at + 46 <= data.length) {
-      if (data.readUInt32LE(at) !== CENTRAL_SIGNATURE) throw new Error("broken zip directory entry");
+      if (data.readUInt32LE(at) !== CENTRAL_SIGNATURE2) throw new Error("broken zip directory entry");
       const madeBy = data.readUInt16LE(at + 4);
       const nameLength = data.readUInt16LE(at + 28);
       const extraLength = data.readUInt16LE(at + 30);
@@ -27883,7 +29121,7 @@ async function readZipEntries(filePath) {
         compressedSize: data.readUInt32LE(at + 20),
         uncompressedSize: data.readUInt32LE(at + 24),
         localOffset: data.readUInt32LE(at + 42),
-        mode: madeBy >> 8 === UNIX_HOST ? external >>> 16 : null
+        mode: madeBy >> 8 === UNIX_HOST2 ? external >>> 16 : null
       };
       applyZip64(data.subarray(at + 46 + nameLength, at + 46 + nameLength + extraLength), entry, {
         uncompressed: entry.uncompressedSize === U32_MAX,
@@ -27900,10 +29138,10 @@ async function readZipEntries(filePath) {
   }
 }
 async function readZipEntryHead(filePath, entry, maxBytes) {
-  const file = await fs42.open(filePath, "r");
+  const file = await fs45.open(filePath, "r");
   try {
     const local = await readAt2(file, entry.localOffset, 30);
-    if (local.length < 30 || local.readUInt32LE(0) !== LOCAL_SIGNATURE) throw new Error(`broken zip entry ${entry.name}`);
+    if (local.length < 30 || local.readUInt32LE(0) !== LOCAL_SIGNATURE2) throw new Error(`broken zip entry ${entry.name}`);
     const start = entry.localOffset + 30 + local.readUInt16LE(26) + local.readUInt16LE(28);
     if (entry.method === 0) return await readAt2(file, start, Math.min(maxBytes, entry.uncompressedSize));
     if (entry.method !== 8) throw new Error(`${entry.name} uses a compression this command cannot read`);
@@ -27915,7 +29153,7 @@ async function readZipEntryHead(filePath, entry, maxBytes) {
 }
 function inflateHead(input, maxBytes) {
   return new Promise((resolve) => {
-    const inflater = zlib2.createInflateRaw();
+    const inflater = zlib3.createInflateRaw();
     const chunks = [];
     let total = 0;
     const finish2 = () => resolve(Buffer.concat(chunks).subarray(0, maxBytes));
@@ -27934,7 +29172,7 @@ function inflateHead(input, maxBytes) {
 var run4 = promisify2(execFile2);
 var NATIVE_PLATFORMS = ["mac", "windows", "linux"];
 var NATIVE_ARCHES = ["arm64", "x64", "universal"];
-var VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+var VERSION2 = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
 var VERSION_MAX = 64;
 var OS_VERSION = /^\d{1,4}(\.\d{1,6}){0,3}$/;
 var ENGINE = /^[a-z][a-z0-9-]{1,39}$/;
@@ -27964,7 +29202,7 @@ function rootApps(entries) {
 }
 function launchableExes(entries) {
   const exes = entries.filter((e) => !isDirectory(e) && e.name.toLowerCase().endsWith(".exe"));
-  const games = exes.filter((e) => e.name.split("/").length <= ENTRY_DEPTH_MAX && !HELPER_EXE.test(path46.posix.basename(e.name)));
+  const games = exes.filter((e) => e.name.split("/").length <= ENTRY_DEPTH_MAX && !HELPER_EXE.test(path48.posix.basename(e.name)));
   const depth = (name) => name.split("/").length;
   return games.map((e) => e.name).sort((a, b) => depth(a) - depth(b) || a.localeCompare(b));
 }
@@ -28046,7 +29284,7 @@ function exeArch(head) {
 }
 function engineOf(entries) {
   const names2 = entries.map((e) => e.name.toLowerCase());
-  const base = (name) => path46.posix.basename(name.replace(/\/$/, ""));
+  const base = (name) => path48.posix.basename(name.replace(/\/$/, ""));
   if (names2.some((n) => /^unityplayer\.(dll|dylib|so)$/.test(base(n)) || base(n) === "globalgamemanagers")) return "unity";
   if (names2.some((n) => n.startsWith("engine/binaries/") || /\.app\/contents\/ue[45]?\//.test(n) || n.includes("/engine/binaries/")))
     return "unreal";
@@ -28090,7 +29328,7 @@ async function describeNativeArchive(zipPath, asked = {}) {
   try {
     entries = await readZipEntries(zipPath);
   } catch (err) {
-    throw new NativeBuildError(`Couldn't read ${path46.basename(zipPath)} as a zip: ${err.message}`);
+    throw new NativeBuildError(`Couldn't read ${path48.basename(zipPath)} as a zip: ${err.message}`);
   }
   if (entries.length === 0) throw new NativeBuildError("The archive is empty.");
   const platform = platformOf(entries, asked.platform);
@@ -28112,19 +29350,19 @@ async function describeNativeArchive(zipPath, asked = {}) {
     ...mac?.appVersion ? { appVersion: mac.appVersion } : {}
   };
 }
-function buildVersion(asked, appVersion, sha2562) {
+function buildVersion(asked, appVersion, sha2563) {
   if (asked !== void 0) {
-    if (asked.length > VERSION_MAX || !VERSION.test(asked)) {
+    if (asked.length > VERSION_MAX || !VERSION2.test(asked)) {
       throw new NativeBuildError(`--build-version "${asked}" may hold only letters, digits and . _ + - (at most ${VERSION_MAX}).`);
     }
     return asked;
   }
-  const hash = sha2562.slice(0, VERSION_SHA_CHARS);
+  const hash = sha2563.slice(0, VERSION_SHA_CHARS);
   const app = (appVersion ?? "").replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, VERSION_MAX - hash.length - 1);
   return app ? `${app}+${hash}` : hash;
 }
 async function hashFile(filePath, onProgress) {
-  const hash = createHash3("sha256");
+  const hash = createHash4("sha256");
   let sizeBytes = 0;
   for await (const chunk of createReadStream(filePath)) {
     hash.update(chunk);
@@ -28135,13 +29373,13 @@ async function hashFile(filePath, onProgress) {
 }
 async function packTarget(dir) {
   if (dir.toLowerCase().endsWith(".app")) return { target: dir, keepParent: true };
-  const children = await fs43.readdir(dir, { withFileTypes: true });
+  const children = await fs46.readdir(dir, { withFileTypes: true });
   const apps = children.filter((d) => d.isDirectory() && d.name.toLowerCase().endsWith(".app"));
-  if (apps.length === 1) return { target: path46.join(dir, apps[0].name), keepParent: true };
+  if (apps.length === 1) return { target: path48.join(dir, apps[0].name), keepParent: true };
   return { target: dir, keepParent: false };
 }
 async function packNativeBuild(input) {
-  const stat = await fs43.stat(input).catch(() => null);
+  const stat = await fs46.stat(input).catch(() => null);
   if (!stat) throw new NativeBuildError(`${input} does not exist.`);
   if (stat.isFile()) {
     if (!input.toLowerCase().endsWith(".zip")) throw new NativeBuildError("Pass a .zip, a .app, or the build's folder.");
@@ -28149,14 +29387,14 @@ async function packNativeBuild(input) {
     } };
   }
   const { target, keepParent } = await packTarget(input);
-  const dir = await fs43.mkdtemp(path46.join(os13.tmpdir(), "genex-native-"));
-  const zipPath = path46.join(dir, `${path46.basename(target).replace(/[^A-Za-z0-9._-]+/g, "-") || "build"}.zip`);
-  const cleanup = () => fs43.rm(dir, { recursive: true, force: true });
+  const dir = await fs46.mkdtemp(path48.join(os13.tmpdir(), "genex-native-"));
+  const zipPath = path48.join(dir, `${path48.basename(target).replace(/[^A-Za-z0-9._-]+/g, "-") || "build"}.zip`);
+  const cleanup = () => fs46.rm(dir, { recursive: true, force: true });
   try {
     if (process.platform === "darwin") {
       await run4("ditto", ["-c", "-k", "--sequesterRsrc", ...keepParent ? ["--keepParent"] : [], target, zipPath]);
     } else if (keepParent) {
-      await run4("zip", ["-q", "-r", "-y", zipPath, path46.basename(target)], { cwd: path46.dirname(target) });
+      await run4("zip", ["-q", "-r", "-y", zipPath, path48.basename(target)], { cwd: path48.dirname(target) });
     } else {
       await run4("zip", ["-q", "-r", "-y", zipPath, "."], { cwd: target });
     }
@@ -28171,7 +29409,7 @@ async function packNativeBuild(input) {
 }
 
 // src/lib/native-upload.ts
-import fs44 from "fs/promises";
+import fs47 from "fs/promises";
 var PART_CONCURRENCY = 2;
 async function call(ctx, route, init, what, log) {
   let res;
@@ -28217,7 +29455,7 @@ async function uploadNativeArchive(grant, zipPath, sizeBytes, log, onProgress) {
   const base = grant.uploadUrl.replace(/\/+$/, "");
   const encoded = grant.uploadPath.split("/").map(encodeURIComponent).join("/");
   const auth = { Authorization: `Bearer ${grant.token}` };
-  const file = await fs44.open(zipPath, "r");
+  const file = await fs47.open(zipPath, "r");
   try {
     if (sizeBytes <= grant.limits.singlePutMaxBytes) {
       const body = await readPart(file, 0, sizeBytes);
@@ -28396,10 +29634,10 @@ async function runPublish2(opts, log) {
     const description = await describeNativeArchive(packed.zipPath, opts);
     log.step(describeLine(description));
     log.step("Hashing the archive\u2026");
-    const { sha256: sha2562, sizeBytes } = await hashFile(packed.zipPath);
-    const version = buildVersion(opts.buildVersion, description.appVersion, sha2562);
+    const { sha256: sha2563, sizeBytes } = await hashFile(packed.zipPath);
+    const version = buildVersion(opts.buildVersion, description.appVersion, sha2563);
     const { platform, arch, entry, installedBytes, minOs, engine } = description;
-    const grant = await requestNativeUpload(ctx, { platform, arch, sha256: sha2562, sizeBytes }, log);
+    const grant = await requestNativeUpload(ctx, { platform, arch, sha256: sha2563, sizeBytes }, log);
     if (!grant) return false;
     if (grant.uploaded) {
       log.step(`Already uploaded (${sizeLine(sizeBytes)}).`);
@@ -28410,7 +29648,7 @@ async function runPublish2(opts, log) {
     }
     const build = await publishNativeBuild(
       ctx,
-      { platform, arch, sha256: sha2562, sizeBytes, installedBytes, version, entry, ...minOs ? { minOs } : {}, ...engine ? { engine } : {} },
+      { platform, arch, sha256: sha2563, sizeBytes, installedBytes, version, entry, ...minOs ? { minOs } : {}, ...engine ? { engine } : {} },
       log
     );
     if (!build) return false;
@@ -28660,6 +29898,25 @@ ${c.bold("Usage")}
                                      --resellable lets players resell the item to each
                                      other on the market; durable items only, off by
                                      default, and --no-resellable turns it back off.
+                                     Store items: --price 0 is Free; --description,
+                                     --tag <word> (repeat; "set <id> --clear-tags"
+                                     empties them), --image <file.png|webp>
+                                     (its transparent picture), --model <file.glb>,
+                                     --package <dir> (files for other games' agents;
+                                     .git, node_modules, .genex, secrets and links
+                                     stay out) and --shared ("other games can use
+                                     it"; durable only). With the store on, "add"
+                                     makes a draft and --json prints it as one
+                                     document (a refusal: one genex.item_error
+                                     line, exit 1). "publish <id>" puts it on sale and
+                                     "unpublish <id>" takes it off \u2014 in the Genex
+                                     app the person presses Put on sale instead.
+  genex items <sub> [words|id]       Other creators' shared items in this game:
+                                     search | add | remove | list. "add <id>" lets
+                                     players use it here (free, not a purchase) and
+                                     writes genex-items/<id>/ \u2014 item.json and the
+                                     author's package \u2014 for your agent to integrate.
+                                     It reaches the store with the next live build.
   genex model "<prompt>" [options]   Generate a 3D model (GLB); prints a public asset URL.
                                      --image <path|url> builds it FROM a reference
                                      image instead (prompt optional). Quality knobs:
@@ -29044,6 +30301,10 @@ ${c.bold("Examples")}
   genex shop set sku_123 --icon https://assets.genex.technology/generations/abc123/image-main
   genex shop test sku_123
   genex shop remove sku_123
+  genex shop add "Frost Axe" --price 1200 --type durable --description "Freezes on hit." --tag axe --image .genex/scratch/axe.png --shared --json
+  genex shop publish sku_123
+  genex items search "wings" --tag fire
+  genex items add sku_456
   genex llm models
   genex llm models --all
   genex llm bench "Reply with one short taunt." --samples 5 --max-credits 20 --user-approved
@@ -29526,6 +30787,10 @@ function parseArgs(argv) {
     "--operation-id",
     "--price",
     "--icon",
+    // `genex shop add|set` and `genex items search`: one search word per --tag.
+    "--tag",
+    // `genex shop add|set --package <dir>`: the item's files for other games' agents.
+    "--package",
     "--rename",
     "--type",
     "--title",
@@ -29793,6 +31058,19 @@ function parseArgs(argv) {
       case "--no-resellable":
         parsed.options.resellable = false;
         break;
+      // `genex shop add|set`: "Other games can use it" (P10). A pair for the
+      // same reason as --resellable: `set` must tell OFF from ABSENT.
+      case "--shared":
+        parsed.options.shared = true;
+        break;
+      case "--no-shared":
+        parsed.options.shared = false;
+        break;
+      // `genex shop set <id> --clear-tags`: --tag replaces the list and an
+      // empty --tag is refused, so emptying it needs its own flag.
+      case "--clear-tags":
+        parsed.options.clearTags = true;
+        break;
       case "--list":
         parsed.options.list = true;
         break;
@@ -29892,6 +31170,8 @@ function parseArgs(argv) {
             parsed.error = `Unexpected argument: ${arg}`;
             return parsed;
           }
+        } else if (parsed.command === "items") {
+          parsed.options.query = parsed.options.query ? `${parsed.options.query} ${arg}` : arg;
         } else if (parsed.command === "domain") {
           if (!parsed.options.hostname) parsed.options.hostname = arg;
           else {
@@ -29931,7 +31211,9 @@ function parseArgs(argv) {
   }
   const imageCount = parsed.options.imageUrls?.length ?? 0;
   if (imageCount > 0) {
-    if (parsed.command === "model" && imageCount > 1) {
+    if (parsed.command === "shop" && imageCount > 1) {
+      parsed.error = "genex shop takes one --image: the item's picture.";
+    } else if (parsed.command === "model" && imageCount > 1) {
       parsed.error = "genex model accepts one --image reference. Use character --image for multiple character views.";
     } else if (parsed.command === "character" || parsed.command === "creature") {
       if (["preview", "finalize", "import", "animate", "motions", "adopt"].includes(parsed.options.name ?? "")) {
@@ -30181,8 +31463,8 @@ function applyValueFlag(options, flag, value) {
     }
     case "--price": {
       const n = Number(value);
-      if (!Number.isInteger(n) || n <= 0) {
-        throw new Error(`Invalid --price value: ${value} (whole coin, e.g. 100)`);
+      if (value.trim() === "" || !Number.isInteger(n) || n < 0) {
+        throw new Error(`Invalid --price value: ${value} (whole coin, e.g. 100; 0 is Free)`);
       }
       options.price = n;
       break;
@@ -30190,6 +31472,16 @@ function applyValueFlag(options, flag, value) {
     case "--icon":
       options.icon = value;
       break;
+    // A forgotten value must not swallow the next flag (`--tag --json` would
+    // tag the item "--json" and print no draft) or vanish (`--package ""`).
+    case "--tag":
+      if (!value.trim() || value.startsWith("--")) throw new Error("Missing value for --tag");
+      (options.itemTags ??= []).push(value);
+      break;
+    case "--package":
+      if (!value.trim() || value.startsWith("--")) throw new Error("Missing value for --package");
+      options.packageDir = value;
+      break;
     case "--type": {
       if (value !== "consumable" && value !== "durable" && !MODEL_RIG_TYPES.includes(value)) {
         throw new Error(
@@ -30493,7 +31785,10 @@ async function main() {
         await runMakeRemixable(parsed.options);
         break;
       case "shop":
-        await runShop(parsed.options);
+        await runShop({ ...parsed.options, picture: parsed.options.imageUrl, modelFile: parsed.options.modelId });
+        break;
+      case "items":
+        await runItems(parsed.options);
         break;
       case "domain":
         await runDomain(parsed.options);