akari-video 1.1.0 → 1.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akari-video",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "AKARI Video launcher CLI — start an AI-edited video project from any directory: scaffold, connection check, then hand over to Claude Code (or opencode). AKARI Video を opencode や Claude Code で、どのディレクトリからでも始めるための `akari` ランチャー CLI。接続確認（doctor）→ 未セットアップならプロジェクト雛形を作成 → AI エージェントを起動する。外部 npm 依存ゼロ（Node.js 組み込みモジュールのみ）。",
   "type": "module",
   "bin": {

package/vendor/docs/contract-2026-08-03-caption-display-encoding-qc-v1.md

@@ -42,10 +42,15 @@ overlap; and reference/output aspect mismatch. A resolved production render stor
 projection digest, and its immutable render receipt references the file and summary.
 Captions with `time_domain: "output"` (placed text) are exempt from overlap and order checks; any number may share the same time (2026-09-22 decision). Source-domain captions retain their per-source checks.
 
-Under `display_policy`, an omitted `captions[].style` remains valid. The known word-display styles
-`karaoke`, `pop`, `reveal`, and `reveal-word` remain `STYLE_CONFLICT` errors, while any other value is
-an `INVALID_CAPTION` error that names the unknown value and the accepted vocabulary. Without
-`display_policy`, caption style handling remains on the unchanged legacy path.
+2026-10-06 amendment: `display_policy.word_style` is the global word display default (`none` when
+omitted, or `karaoke`). An explicit `captions[].style: "karaoke"` or `"plain"` takes priority over
+that default; `plain` restores ordinary display for one row under a global karaoke policy.
+Under `display_policy`, `pop`, `reveal`, and `reveal-word` remain `STYLE_CONFLICT` errors, while any
+unknown style is `INVALID_CAPTION`. Karaoke uses measured `words[]` projected into each resolved
+fragment. Missing words or synthetic timing fall back to ordinary text. Without `display_policy`,
+caption style handling remains on the unchanged legacy path.
+If measured words omit only punctuation, symbols, or whitespace, those characters remain visible as
+untimed unlit tokens while the measured words keep karaoke timing; other text mismatches fall back to ordinary text.
 
 `reference-pixel` geometry is scaled only after exact aspect agreement. `webkit-outline` produces
 real `-webkit-text-stroke` plus `paint-order:stroke fill` and disables shadow. Single-line consumers

package/vendor/docs/contract-2026-10-04-asset-tier-v1.md

@@ -42,3 +42,11 @@ JSON Schema は `remote: true` なら `source` 必須までを表し、akari-r2
 `preview` URL は `https://akari.video/lab/media/telop-rich-pack/textstyle/<id>.png` の形とする。
 配置後は既存の textstyle ライブラリ読み込みが `preset.json` を読み、
 「テキスト > スタイル」へ並べる。未取得 textstyle の棚カード表示は別票で扱う。
+
+## § Pro item の 1 件ずつの取得（2026-10-06）
+
+resolver は取得済みの素材をキャッシュから先に返す。新規取得の Pro item は店の entitlements と catalog 行で資格を事前判定し、資格があれば `GET /api/store/v1/assets/<category>/<id>` で記述子を取得する。記述子が示す各ファイルを Bearer 認証で取得し、`sha256` と `bytes` を照合する。`meta.json` を必須として `validate-asset` に通し、全件成功後に `<ライブラリ>/<category>/<id>/` へ原子的に配置する。失敗時は一時ディレクトリを破棄する。
+
+記述子の `schema` は `akari-pro-asset/v1`。`category`、`id`、正の整数 `version` と、空でない `files` 配列を持つ。各 `files[]` は相対パス `name`、小文字 64 桁の `sha256`、0 以上の整数 `bytes`、記述子 API と同じオリジンの絶対 HTTP(S) `url` を持つ。`name` は `/` 区切りで、空の区間、`.`、`..`、先頭の `/`、バックスラッシュ、NUL を含めない。`name` は一意で `meta.json` を必ず含む。
+
+記述子またはファイル取得で 409 `stale_version` が返ったら、一時取得物を捨てて記述子を 1 回だけ取り直す。記述子 API が 404 `asset_not_found` を返した場合だけ、`product_id ?? id` の束 zip 取得へ進む。束 zip は予備経路として段階的に退役する。記述子 API の上書きは `AKARI_PRO_ASSET_API` を使い、`AKARI_STORE_API`、接続情報の URL、既定ホストより優先する。

package/vendor/packages/akari-launcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akari-video",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "AKARI Video launcher CLI — start an AI-edited video project from any directory: scaffold, connection check, then hand over to Claude Code (or opencode). AKARI Video を opencode や Claude Code で、どのディレクトリからでも始めるための `akari` ランチャー CLI。接続確認（doctor）→ 未セットアップならプロジェクト雛形を作成 → AI エージェントを起動する。外部 npm 依存ゼロ（Node.js 組み込みモジュールのみ）。 [akari-video npm vendor: bin/akari.mjs is reference-only. These CLI entrypoints are not included in the akari-video npm package. Use `akari doctor --json` and run the path reported in `render_cut.path`. Full installations provide it in a monorepo checkout, ~/.akari/app, /Applications/AKARI Video.app/Contents/Resources/packages, or %LOCALAPPDATA%\\Programs\\@akari-videoshell\\resources\\packages.]",
   "type": "module",
   "files": [

package/vendor/packages/asset-resolver/bin/akari-assets.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // akari-assets — 素材 resolver v0 の CLI（list / add / fetch / bundle / migrate / sync / browse）。
 //
-//   akari-assets list [--category <c>] [--source <lab|site|own>] [--json]
+//   akari-assets list [--category <c>] [--source <lab|site|own>] [--tag <t> ...] [--query <s>] [--json]
 //   akari-assets add <path...> --plan [--json]
 //   akari-assets add --apply <plan.json> [--json]
 //   akari-assets fetch <ref> [--project <dir>] [--reference] [--force]  （ref は category/id）
@@ -19,6 +19,7 @@ import { resolve as resolveAsset } from '../src/resolve.mjs';
 import { DEFAULT_CATALOG_URL, DEFAULT_STORE_API } from '../src/service-urls.mjs';
 import { composeState } from '../src/state.mjs';
 import { checkLibrary, projectCredits } from '../src/library-check.mjs';
+import { filterListItems } from '../src/list-filter.mjs';
 
 function flagValue(args, name) {
   const i = args.indexOf(name);
@@ -28,7 +29,7 @@ function flagValue(args, name) {
 // Validate the entire command before any handler can read or mutate user data.
 function validateArgs(sub, args) {
   const specs = {
-    list: { values: ['--category', '--source'], flags: ['--json'], max: 0 },
+    list: { values: ['--category', '--source', '--tag', '--query'], flags: ['--json'], max: 0 },
     add: { values: ['--apply'], flags: ['--plan', '--json'], max: Infinity },
     fetch: { values: ['--project'], flags: ['--reference', '--force'], min: 1, max: 1 },
     bundle: { values: ['--project'], flags: ['--dry-run'], max: 0 },
@@ -46,7 +47,7 @@ function validateArgs(sub, args) {
     const arg = args[i];
     if (!arg.startsWith('-')) { positional.push(arg); continue; }
     if (!spec.values.includes(arg) && !spec.flags.includes(arg)) throw new Error(`不明なオプション: ${arg}`);
-    if (seen.has(arg)) throw new Error(`重複したオプション: ${arg}`);
+    if (seen.has(arg) && !(sub === 'list' && arg === '--tag')) throw new Error(`重複したオプション: ${arg}`);
     seen.add(arg);
     if (spec.values.includes(arg) && (!args[++i] || args[i].startsWith('-'))) throw new Error(`${arg} には値が必要です`);
   }
@@ -76,10 +77,12 @@ async function cmdList(args, env) {
   const category = flagValue(args, '--category');
   const asJson = args.includes('--json');
   const source = flagValue(args, '--source');
+  const tags = args.flatMap((arg, index) => arg === '--tag' ? [args[index + 1]] : []);
+  const query = flagValue(args, '--query');
   if (args.includes('--source') && !['lab', 'site', 'own'].includes(source)) throw new Error('--source は lab / site / own で指定してください');
   const { libraryRoots, items, warnings } = await composeState({ env });
   for (const warning of warnings) console.error(`警告: ${warning}`);
-  const filtered = items.filter(item => (!category || item.category === category) && (!source || item.sourceKind === source));
+  const filtered = filterListItems(items, { category, source, tags, query });
 
   if (asJson) {
     console.log(JSON.stringify(filtered, null, 2));
@@ -88,7 +91,7 @@ async function cmdList(args, env) {
 
   console.log(`使える素材 ${filtered.length} 件（ライブラリ: ${libraryRoots.write}）`);
   for (const item of filtered) {
-    console.log(`  ${badgeOf(item)}  ${item.category}/${item.id}\t${item.sourceKind}\t[${item.category}]\t${item.title}`);
+    console.log(`  ${badgeOf(item)}  ${item.category}/${item.id}\t${item.sourceKind}\t[${item.category}]\t${item.tier === 'pro' ? 'pro' : 'free'}\t${item.title}`);
   }
 }
 
@@ -199,8 +202,8 @@ async function cmdCredits(args, env) {
 function printUsage() {
   console.log(`使い方: akari-assets <list|add|fetch|bundle|migrate|sync|browse|check|credits> [options]
 
-  list [--category <c>] [--source <lab|site|own>] [--json]
-                                          出どころ・取得状態つき素材一覧
+  list [--category <c>] [--source <lab|site|own>] [--tag <t> ...] [--query <s>] [--json]
+                                          タグ完全一致（複数は AND）・題名/id/タグ部分一致で絞る素材一覧
   add <path...> --plan [--json]           ローカル素材の取り込み計画（書き込みなし）
   add --apply <plan.json> [--json]        計画で選択した素材を複製して登録
   fetch <ref> [--project <dir>] [--reference] [--force]

package/vendor/packages/asset-resolver/src/bundle.mjs

@@ -14,7 +14,7 @@ export async function bundleProjectReferences({
   for (const reference of planned) {
     try {
       if (!isAssetCached(env, reference.category, reference.id)) {
-        const resolved = await resolveAsset(reference.id, { env });
+        const resolved = await resolveAsset(`${reference.category}/${reference.id}`, { env });
         if (resolved.category !== reference.category) {
           throw new Error(
             `カタログのカテゴリが台帳と一致しません: ${reference.category}/${reference.id}（実際: ${resolved.category}）`,

package/vendor/packages/asset-resolver/src/env.mjs

@@ -90,3 +90,18 @@ export function resolveDownloadUrl(env = process.env, credentials, productId) {
   }
   return `${DEFAULT_STORE_API}/api/store/v1/download/${encodeURIComponent(productId)}`;
 }
+
+/** Pro item の記述子 API。専用上書き → 店 API → 接続情報 → 既定ホスト。 */
+export function resolveProAssetUrl(env = process.env, credentials, category, id) {
+  const suffix = `${encodeURIComponent(category)}/${encodeURIComponent(id)}`;
+  if (env.AKARI_PRO_ASSET_API) {
+    return `${trimTrailingSlash(env.AKARI_PRO_ASSET_API)}/api/store/v1/assets/${suffix}`;
+  }
+  if (env.AKARI_STORE_API) {
+    return `${trimTrailingSlash(env.AKARI_STORE_API)}/api/store/v1/assets/${suffix}`;
+  }
+  if (credentials?.url) {
+    return `${trimTrailingSlash(credentials.url)}/v1/assets/${suffix}`;
+  }
+  return `${DEFAULT_STORE_API}/api/store/v1/assets/${suffix}`;
+}

package/vendor/packages/asset-resolver/src/fetch-file.mjs

@@ -6,11 +6,12 @@
 // （開発時は store リポのローカル出力を指す運用）。
 
 import { createWriteStream } from 'node:fs';
-import { copyFile, mkdir } from 'node:fs/promises';
+import { copyFile, mkdir, rm } from 'node:fs/promises';
 import path from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { isRemoteLocation } from './env.mjs';
+import { AssetResolverError } from './errors.mjs';
 
 export const DEFAULT_FETCH_TIMEOUTS = { responseMs: 15_000, idleMs: 30_000 };
 
@@ -98,14 +99,50 @@ export function resolvePreviewLocation(base, preview) {
 }
 
 /** 解決済みロケーションを destPath へ実体化する（リモートは fetch、ローカルはファイルコピー） */
-export async function materialize({ location, remote }, destPath, { fetchImpl = fetch, timeouts } = {}) {
+export async function materialize({ location, remote }, destPath, { fetchImpl = fetch, timeouts, request, maxBytes } = {}) {
   await mkdir(path.dirname(destPath), { recursive: true });
   if (remote) {
-    const { response: res, controller } = await fetchTimed(location, { fetchImpl, timeouts, label: '素材ファイル' });
+    const { response: res, controller } = await fetchTimed(location, { fetchImpl, request, timeouts, label: '素材ファイル' });
     if (!res.ok || !res.body) {
-      throw new Error(`ダウンロード失敗: ${location} → HTTP ${res.status}`);
+      if (!request) throw new Error(`ダウンロード失敗: ${location} → HTTP ${res.status}`);
+      let detail = '';
+      let storeCode;
+      try {
+        const data = await readTimedJson(res, controller, { timeouts, label: '素材ファイル' });
+        storeCode = typeof data?.error === 'string' ? data.error : undefined;
+        detail = [storeCode, typeof data?.message === 'string' ? data.message : ''].filter(Boolean).join(': ');
+      } catch (error) {
+        if (error instanceof Error && error.message.includes('時間切れ')) throw error;
+        // エラー本文が JSON でない場合も HTTP status を残す。
+      }
+      controller.abort();
+      const error = new Error(`ダウンロード失敗: ${location} → HTTP ${res.status}${detail ? ` (${detail})` : ''}`);
+      error.status = res.status;
+      error.storeCode = storeCode;
+      throw error;
+    }
+    if (maxBytes === undefined) {
+      await pipeline(Readable.from(timedBody(res.body, controller, { timeouts, label: '素材ファイル' })), createWriteStream(destPath));
+      return;
+    }
+    async function* limitedBody() {
+      let received = 0;
+      for await (const chunk of timedBody(res.body, controller, { timeouts, label: '素材ファイル' })) {
+        received += chunk.byteLength;
+        if (received > maxBytes) {
+          controller.abort();
+          throw new AssetResolverError(`bytes が宣言値を超えました: ${received} > ${maxBytes}`, 'integrity');
+        }
+        yield chunk;
+      }
+    }
+    try {
+      await pipeline(Readable.from(limitedBody()), createWriteStream(destPath));
+    } catch (error) {
+      controller.abort();
+      await rm(destPath, { force: true });
+      throw error;
     }
-    await pipeline(Readable.from(timedBody(res.body, controller, { timeouts, label: '素材ファイル' })), createWriteStream(destPath));
     return;
   }
   await copyFile(location, destPath);

package/vendor/packages/asset-resolver/src/list-filter.mjs

@@ -0,0 +1,10 @@
+/** Filter composed catalogue rows without changing their order or contents. */
+export function filterListItems(items, { category, source, tags = [], query } = {}) {
+  const needle = query?.toLocaleLowerCase();
+  return items.filter(item =>
+    (!category || item.category === category)
+    && (!source || item.sourceKind === source)
+    && tags.every(tag => item.tags?.includes(tag))
+    && (!needle || [item.title, item.id, ...(item.tags ?? [])]
+      .some(value => typeof value === 'string' && value.toLocaleLowerCase().includes(needle))));
+}

package/vendor/packages/asset-resolver/src/pro-asset.mjs

@@ -0,0 +1,103 @@
+// Pro item の記述子と店の HTTP 応答を検査する。ファイル取得前に全件を検査する。
+import { AssetResolverError } from './errors.mjs';
+import { resolveProAssetUrl } from './env.mjs';
+import { fetchTimed, readTimedJson } from './fetch-file.mjs';
+
+function timedOut(error) {
+  return error instanceof Error && error.message.includes('時間切れ');
+}
+
+export function storeFailure(status, data, context) {
+  const storeCode = typeof data?.error === 'string' ? data.error : undefined;
+  const message = typeof data?.message === 'string' ? data.message : undefined;
+  const details = [storeCode, message].filter(Boolean).join(': ');
+  const error = new AssetResolverError(
+    `${context}に失敗しました（HTTP ${status ?? '不明'}${details ? `: ${details}` : ''}）`,
+    status === 401 || (status === 403 && storeCode === 'pro_required') ? 'locked' : 'download_failed',
+  );
+  error.status = status;
+  error.storeCode = storeCode;
+  return error;
+}
+
+function invalid(reason) {
+  throw new AssetResolverError(`Pro 素材の記述子が不正です: ${reason}`, 'integrity');
+}
+
+export function validateProAssetDescriptor(data, item, descriptorUrl) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) invalid('JSON object が必要です');
+  if (data.schema !== 'akari-pro-asset/v1') invalid('schema');
+  if (data.category !== item.category || data.id !== item.id) invalid('category/id');
+  if (!Number.isInteger(data.version) || data.version <= 0) invalid('version');
+  if (!Array.isArray(data.files) || data.files.length === 0) invalid('files');
+  const origin = new URL(descriptorUrl).origin;
+  const names = new Set();
+  const files = [];
+  for (const file of data.files) {
+    if (!file || typeof file !== 'object' || Array.isArray(file)) invalid('file');
+    if (Object.keys(file).length !== 4
+      || Object.keys(file).some(key => !['name', 'sha256', 'bytes', 'url'].includes(key))) invalid('file のキー');
+    const name = file.name;
+    if (typeof name !== 'string' || !name || name.startsWith('/') || name.includes('\\')
+      || name.split('/').some(part => !part || part === '.' || part === '..'
+        || /[:\x00-\x1f\x7f<>"|?*]/.test(part) || /[. ]$/.test(part)
+        || /^(?:con|prn|aux|nul|com[0-9]|lpt[0-9])(?:\.|$)/i.test(part))) invalid('name');
+    const foldedName = name.toLowerCase();
+    if (names.has(foldedName)) invalid('name が重複しています');
+    names.add(foldedName);
+    if (typeof file.sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(file.sha256)) invalid('sha256');
+    if (!Number.isInteger(file.bytes) || file.bytes < 0) invalid('bytes');
+    let url;
+    try { url = new URL(file.url); } catch { invalid('url'); }
+    if (!['http:', 'https:'].includes(url.protocol) || url.origin !== origin) invalid('url のオリジン');
+    files.push({ name, sha256: file.sha256, bytes: file.bytes, url: file.url });
+  }
+  if (!files.some(file => file.name === 'meta.json')) invalid('meta.json');
+  return { ...data, files };
+}
+
+/** 404 asset_not_found だけを null として返し、zip 予備経路へ渡す。 */
+export async function fetchProAssetDescriptor(item, credentials, { env, fetchImpl, timeouts }) {
+  const url = resolveProAssetUrl(env, credentials, item.category, item.id);
+  let res;
+  let controller;
+  try {
+    ({ response: res, controller } = await fetchTimed(url, {
+      fetchImpl, request: { headers: { authorization: `Bearer ${credentials.token}` }, redirect: 'error' },
+      timeouts, label: 'Pro 素材の記述子',
+    }));
+  } catch (error) {
+    throw new AssetResolverError(`Pro 素材の記述子取得に失敗しました: ${error.message}`, timedOut(error) ? 'timeout' : 'download_failed');
+  }
+  let data;
+  try {
+    data = await readTimedJson(res, controller, { timeouts, label: 'Pro 素材の記述子' });
+  } catch (error) {
+    if (timedOut(error)) throw new AssetResolverError(error.message, 'timeout');
+    if (res.ok) invalid('JSON');
+    const failure = storeFailure(res.status, null, 'Pro 素材の記述子取得');
+    if (res.status === 401) failure.message += '。トークン失効の可能性があります。akari store connect をやり直してください';
+    throw failure;
+  } finally {
+    controller.abort();
+  }
+  if (!res.ok) {
+    if (res.status === 404 && data?.error === 'asset_not_found') return null;
+    if (res.status === 403 && data?.error === 'pro_required') {
+      const error = new AssetResolverError(
+        `Pro 素材は all-access-pass（Lifetime パス）または購入済み product_id が必要です: ${item.id}${data?.message ? `（${data.message}）` : ''}`,
+        'locked',
+      );
+      error.status = res.status;
+      error.storeCode = data.error;
+      throw error;
+    }
+    if (res.status === 401) {
+      const failure = storeFailure(res.status, data, 'Pro 素材の記述子取得');
+      failure.message += '。トークン失効の可能性があります。akari store connect をやり直してください';
+      throw failure;
+    }
+    throw storeFailure(res.status, data, 'Pro 素材の記述子取得');
+  }
+  return validateProAssetDescriptor(data, item, url);
+}

package/vendor/packages/asset-resolver/src/resolve.mjs

@@ -7,9 +7,8 @@ import { resolveAssetLibraryRoots } from '../../creator-root/src/index.mjs';
 // 失敗は fail-closed（一時ディレクトリを破棄し、登録先には部分状態を残さない）。
 // 有料未購入（locked）は resolve を拒否する。
 //
-// Pro item は公開 catalog に files[] を持たない（実体は非公開 R2 のまま）。entitled
-// なら resolvePaidZip() が `/api/store/v1/download/<id>` から zip を取得し、展開 →
-// checksums.txt 検証（paid-zip.mjs）→ 同じ validate-asset / 原子的 move の経路に合流する。
+// Pro item は公開 catalog に files[] を持たない。記述子 API から 1 件ずつ取得する。
+// 記述子が asset_not_found のときだけ、従来の束 zip を予備経路として使う。
 
 import { spawn } from 'node:child_process';
 import { constants } from 'node:fs';
@@ -25,6 +24,7 @@ import { materialize, resolveFileLocation } from './fetch-file.mjs';
 import { sha256File } from './hash.mjs';
 import { downloadPaidZip, extractZip, verifyPaidZipContents } from './paid-zip.mjs';
 import { recordProjectReference } from './project-references.mjs';
+import { fetchProAssetDescriptor, storeFailure } from './pro-asset.mjs';
 import { assetTier, isAssetEntitled } from './tier.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -155,7 +155,12 @@ async function moveIntoLibrary(tempDir, destDir) {
   } catch (error) {
     // 一時ディレクトリと登録先が別ファイルシステムの場合（EXDEV）は copy + rm でフォールバック
     if (error && error.code === 'EXDEV') {
-      await cp(tempDir, destDir, { recursive: true, mode: constants.COPYFILE_FICLONE });
+      try {
+        await cp(tempDir, destDir, { recursive: true, mode: constants.COPYFILE_FICLONE });
+      } catch (copyError) {
+        await rm(destDir, { recursive: true, force: true });
+        throw copyError;
+      }
       await rm(tempDir, { recursive: true, force: true });
       return;
     }
@@ -176,6 +181,98 @@ async function backfillLegacyMetaTier(metaPath, item) {
   await writeFile(metaPath, `${JSON.stringify(meta, null, 2)}\n`);
 }
 
+async function fetchFilesInto(files, tempAssetDir, item, { base, fetchImpl, timeouts, request, checkBytes = false, proUrlsOnly = false }) {
+  for (const file of files) {
+    if (typeof file.name !== 'string' || !file.name) {
+      throw new AssetResolverError(`files[] エントリに name がありません: ${item.id}`, 'invalid_catalog_item');
+    }
+  }
+  for (let start = 0; start < files.length; start += 4) {
+    const batch = files.slice(start, start + 4);
+    const results = await Promise.allSettled(batch.map(async file => {
+      const destPath = path.join(tempAssetDir, file.name);
+      const resolved = proUrlsOnly ? { location: file.url, remote: true } : resolveFileLocation(base, file);
+      await materialize(resolved, destPath, { fetchImpl, timeouts, request, ...(proUrlsOnly ? { maxBytes: file.bytes } : {}) });
+      if (file.sha256) {
+        const actual = await sha256File(destPath);
+        if (actual !== file.sha256) {
+          throw new AssetResolverError(
+            `sha256 が一致しません（改竄または破損の可能性）: ${item.id}/${file.name}（期待 ${file.sha256} / 実際 ${actual}）`,
+            'integrity',
+          );
+        }
+      }
+      if (checkBytes) {
+        const actual = (await stat(destPath)).size;
+        if (actual !== file.bytes) {
+          throw new AssetResolverError(`bytes が一致しません: ${item.id}/${file.name}（期待 ${file.bytes} / 実際 ${actual}）`, 'integrity');
+        }
+      }
+    }));
+    const stale = checkBytes && results.find(result => result.status === 'rejected'
+      && result.reason?.status === 409 && result.reason?.storeCode === 'stale_version');
+    if (stale) throw stale.reason;
+    const failed = results.find(result => result.status === 'rejected');
+    if (failed) throw failed.reason;
+  }
+}
+
+async function resolveProAsset(item, credentials, options) {
+  const { env, fetchImpl, project, reference, home, destDir, timeouts } = options;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    let tempRoot;
+    try {
+      const descriptor = await fetchProAssetDescriptor(item, credentials, { env, fetchImpl, timeouts });
+      if (descriptor === null) return resolvePaidZip(item, options);
+      await mkdir(home, { recursive: true });
+      tempRoot = await mkdtemp(path.join(home, '.tmp-resolve-'));
+      const tempAssetDir = path.join(tempRoot, item.category, item.id);
+      await mkdir(tempAssetDir, { recursive: true });
+      try {
+        await fetchFilesInto(descriptor.files, tempAssetDir, item, {
+          base: null, fetchImpl, timeouts, checkBytes: true, proUrlsOnly: true,
+          request: { headers: { authorization: `Bearer ${credentials.token}` }, redirect: 'error' },
+        });
+      } catch (error) {
+        if (error.status === 401) {
+          const failure = storeFailure(error.status, { error: error.storeCode }, 'Pro 素材のファイル取得');
+          failure.message += `。${error.message}。トークン失効の可能性があります。akari store connect をやり直してください`;
+          throw failure;
+        }
+        if (error.status === 403 && error.storeCode === 'pro_required') {
+          throw new AssetResolverError(
+            `Pro 素材は all-access-pass（Lifetime パス）または購入済み product_id が必要です: ${item.id}（${error.message}）`,
+            'locked',
+          );
+        }
+        if (error.status) throw storeFailure(error.status, { error: error.storeCode, message: error.message }, 'Pro 素材のファイル取得');
+        if (error instanceof AssetResolverError) throw error;
+        throw new AssetResolverError(`Pro 素材のファイル取得に失敗しました: ${error.message}`, error.message?.includes('時間切れ') ? 'timeout' : 'download_failed');
+      }
+      await backfillLegacyMetaTier(path.join(tempAssetDir, 'meta.json'), item);
+      const validation = await validateAsset(tempAssetDir);
+      if (validation.status !== 0) {
+        const output = `${validation.stdout ?? ''}${validation.stderr ?? ''}`.trim();
+        throw new AssetResolverError(`validate-asset 検証に失敗しました: ${item.id}\n${output}`, 'validation');
+      }
+      await moveIntoLibrary(tempAssetDir, destDir);
+      const result = { id: item.id, category: item.category, dir: destDir, cached: false };
+      if (project && reference) {
+        await recordProjectReference(project, item);
+        result.referenced = true;
+      } else if (project) {
+        result.projectDir = await copyIntoProject(destDir, project, item.category, item.id);
+      }
+      return result;
+    } catch (error) {
+      if (error.status === 409 && error.storeCode === 'stale_version' && attempt === 0) continue;
+      throw error;
+    } finally {
+      if (tempRoot) await rm(tempRoot, { recursive: true, force: true }).catch(() => {});
+    }
+  }
+}
+
 /**
  * @param {string} ref カタログの category/id。bare id は一意な場合のみ互換解決する
  * @param {{ env?: object, fetchImpl?: Function, project?: string|null, force?: boolean, reference?: boolean }} options
@@ -219,10 +316,12 @@ export async function resolve(
         'locked',
       );
     }
-    // 有料カタログ item は files[] を持たない設計（実体は非公開 R2 のまま。tools/publish-free.mjs
-    // 側の掲載規律の裏返し）。entitled 済みなら zip ダウンロード経路（契約 §6/§8）で取得する。
     if (!hasFiles) {
-      return resolvePaidZip(item, { env, fetchImpl, project, reference, home, destDir, timeouts });
+      const credentials = await readStoreCredentials(env);
+      if (!credentials) {
+        throw new AssetResolverError(`AKARI アカウントの接続情報がありません（トークン失効の可能性）: ${item.id}`, 'locked');
+      }
+      return resolveProAsset(item, credentials, { env, fetchImpl, project, reference, home, destDir, timeouts });
     }
   }
 
@@ -241,30 +340,7 @@ export async function resolve(
   try {
     await mkdir(tempAssetDir, { recursive: true });
     const hasMeta = item.files.some(file => file.name === 'meta.json');
-    for (const file of item.files) {
-      if (typeof file.name !== 'string' || !file.name) {
-        throw new AssetResolverError(`files[] エントリに name がありません: ${item.id}`, 'invalid_catalog_item');
-      }
-    }
-    for (let start = 0; start < item.files.length; start += 4) {
-      const batch = item.files.slice(start, start + 4);
-      const results = await Promise.allSettled(batch.map(async file => {
-        const destPath = path.join(tempAssetDir, file.name);
-        const resolved = resolveFileLocation(base, file);
-        await materialize(resolved, destPath, { fetchImpl, timeouts });
-        if (file.sha256) {
-          const actual = await sha256File(destPath);
-          if (actual !== file.sha256) {
-            throw new AssetResolverError(
-              `sha256 が一致しません（改竄または破損の可能性）: ${item.id}/${file.name}（期待 ${file.sha256} / 実際 ${actual}）`,
-              'integrity',
-            );
-          }
-        }
-      }));
-      const failed = results.find(result => result.status === 'rejected');
-      if (failed) throw failed.reason;
-    }
+    await fetchFilesInto(item.files, tempAssetDir, item, { base, fetchImpl, timeouts });
 
     // still / scene3d 等、meta.json を実体に持つ素材は validate-asset で契約検証してから登録する
     if (hasMeta) {

package/vendor/packages/asset-resolver/test/installed-assets.test.mjs

@@ -179,8 +179,8 @@ for (const indexState of ['missing', 'empty']) {
     assert.equal(list.status, 0, list.stderr);
     assert.equal(list.stdout,
       `使える素材 2 件（ライブラリ: ${path.join(home, 'assets')}）\n`
-      + '  ☁  still/mini-still\tlab\t[still]\tフィクスチャ素材 mini-still\n'
-      + '  🔒 Pro  still/mini-paid\tlab\t[still]\tフィクスチャ素材 mini-paid（有料）\n');
+      + '  ☁  still/mini-still\tlab\t[still]\tfree\tフィクスチャ素材 mini-still\n'
+      + '  🔒 Pro  still/mini-paid\tlab\t[still]\tpro\tフィクスチャ素材 mini-paid（有料）\n');
 
     const fetchResult = runCli(['fetch', 'mini-still'], env);
     assert.equal(fetchResult.status, 0, fetchResult.stderr);

package/vendor/packages/asset-resolver/test/list-filter.test.mjs

@@ -0,0 +1,54 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { filterListItems } from '../src/list-filter.mjs';
+
+const rows = [
+  { category: 'overlay', id: 'blue-card', title: 'Blue Card', tags: ['sticker', 'blue'], sourceKind: 'lab' },
+  { category: 'overlay', id: 'red-card', title: '赤いカード', tags: ['sticker', 'red'], sourceKind: 'lab' },
+  { category: 'audio', id: 'tap', title: 'Tap', tags: ['blue', 'sound'], sourceKind: 'site' },
+];
+
+test('list filters tags with exact AND matching', () => {
+  assert.deepEqual(filterListItems(rows, { tags: ['sticker'] }).map(item => item.id), ['blue-card', 'red-card']);
+  assert.deepEqual(filterListItems(rows, { tags: ['sticker', 'blue'] }).map(item => item.id), ['blue-card']);
+  assert.deepEqual(filterListItems(rows, { tags: ['stick'] }), []);
+});
+
+test('list query matches title, id, and tags without case', () => {
+  for (const query of ['BLUE CARD', 'BLUE-CARD', 'STICKER']) {
+    assert.deepEqual(filterListItems(rows, { query, category: 'overlay', source: 'lab' }).map(item => item.id),
+      query === 'STICKER' ? ['blue-card', 'red-card'] : ['blue-card']);
+  }
+  assert.deepEqual(filterListItems(rows, { query: 'missing' }), []);
+});
+
+const cli = fileURLToPath(new URL('../bin/akari-assets.mjs', import.meta.url));
+const cliSource = readFileSync(cli, 'utf8');
+const validateArgs = new Function(`${cliSource.slice(cliSource.indexOf('function validateArgs('), cliSource.indexOf('const STATE_BADGE'))}\nreturn validateArgs;`)();
+test('list CLI accepts repeated tags and rejects repeated or missing query values', () => {
+  assert.doesNotThrow(() => validateArgs('list', ['--tag', 'sticker', '--tag', 'blue', '--query', 'CARD', '--json']));
+  for (const args of [['--query', 'a', '--query', 'b'], ['--query'], ['--tag'], ['--tag', 'a', '--tag']]) {
+    assert.throws(() => validateArgs('list', args), /重複したオプション|値が必要/);
+  }
+});
+
+test('list human output keeps badge and origin columns and adds tier before title', async () => {
+  const printed = [];
+  const source = cliSource.slice(cliSource.indexOf('function flagValue('), cliSource.indexOf('// Validate the entire command'))
+    + cliSource.slice(cliSource.indexOf('const STATE_BADGE'), cliSource.indexOf('async function cmdAdd('));
+  const cmdList = new Function('filterListItems', 'composeState', 'console', `${source}\nreturn cmdList;`)(
+    filterListItems,
+    async () => ({ libraryRoots: { write: 'library' }, warnings: [], items: [
+      { category: 'overlay', id: 'free-card', title: 'Free Card', sourceKind: 'lab', tier: 'free', state: 'available' },
+      { category: 'overlay', id: 'pro-card', title: 'Pro Card', sourceKind: 'lab', tier: 'pro', state: 'locked' },
+    ] }),
+    { log: line => printed.push(line), error: line => printed.push(line) });
+  await cmdList([], {});
+  assert.deepEqual(printed, [
+    '使える素材 2 件（ライブラリ: library）',
+    '  ☁  overlay/free-card\tlab\t[overlay]\tfree\tFree Card',
+    '  🔒 Pro  overlay/pro-card\tlab\t[overlay]\tpro\tPro Card',
+  ]);
+});

package/vendor/packages/asset-resolver/test/resolve-paid-zip.test.mjs

@@ -125,6 +125,9 @@ function fetchImplFor(id, { entitled, zipPath }) {
       assert.equal(options.headers?.authorization, 'Bearer akst_test');
       return { ok: true, json: async () => ({ entitlements: entitled ? [{ product_id: 'all-access-pass' }] : [] }) };
     }
+    if (/\/v1\/assets\/[^/]+\/[^/]+$/.test(s)) {
+      return { ok: false, status: 404, json: async () => ({ error: 'asset_not_found', message: '記述子はありません' }) };
+    }
     if (s.endsWith(`/v1/download/${id}`)) {
       assert.equal(options.headers?.authorization, 'Bearer akst_test');
       if (!zipPath) {
@@ -327,6 +330,9 @@ test('textstyle Pro 2 件: 未契約は locked、パスで available、束 zip
     if (String(url).endsWith('/v1/entitlements')) {
       return { ok: true, status: 200, json: async () => ({ pass: pass ? { tier: 1, seat_no: 1 } : null, entitlements: [] }) };
     }
+    if (/\/v1\/assets\/[^/]+\/[^/]+$/.test(String(url))) {
+      return { ok: false, status: 404, json: async () => ({ error: 'asset_not_found', message: '記述子はありません' }) };
+    }
     assert.ok(pass, '未契約では zip を取得しない');
     assert.ok(String(url).endsWith(`/v1/download/${productId}`));
     return { ok: true, status: 200, body: Readable.toWeb(createReadStream(zipPath)) };
@@ -379,6 +385,9 @@ test('Lifetime パスの展開済み entitlements でパック全件が availabl
     if (String(url).endsWith('/v1/entitlements')) {
       return { ok: true, status: 200, json: async () => ({ entitlements }) };
     }
+    if (/\/v1\/assets\/[^/]+\/[^/]+$/.test(String(url))) {
+      return { ok: false, status: 404, json: async () => ({ error: 'asset_not_found', message: '記述子はありません' }) };
+    }
     downloads.push(String(url));
     assert.ok(String(url).endsWith(`/v1/download/${productId}`));
     return { ok: true, status: 200, body: Readable.toWeb(createReadStream(zipPath)) };