Take the marketplace through the API, and stop pinning versions - #10

Reopens #8, which GitHub auto-closed when its base branch was deleted on merging #7. Same commit, rebased onto main; the diff is unchanged.

Client half of taking the marketplace through the API. Pairs with aviorstudio/termcade-be#6.

Packages come through the registry

Fetch is gone. Download resolves and then streams from an authed endpoint on the API, with the session attached.

That is what makes "installing requires an account" true rather than merely enforced in this client — before #7 the TUI install path was fully anonymous and the CLI let marketplace ids through unauthenticated, and even after it, anything holding a resolve response could fetch the asset directly. It also gives the Expo app the same path the arcade uses instead of a second one to build.

Still a product boundary, not an access control. The games are open source and their release assets are public; anyone can still fetch them. The account buys a library that follows you, not access to bytes.

The digest keeps doing real work: it ties what arrives to what the registry validated at publish time, across a hop the registry does not control. A mismatch or a missing digest is fatal.

No pinned versions

add author/slug@1.2.3 no longer resolves. Resolve no longer takes a version.

A game is not a dependency — nothing builds against one — so the reasons a package manager pins do not apply, and the two cases people would pin for (reproducing a bug report, escaping a bad release) are author problems with author solutions. The ABI still narrows the choice, but that was never about versions: the registry picks the newest release this binary can run, so a game that has moved on tells you to update termcade rather than handing you a package the host would refuse.

The old spelling gets a real answer rather than open aviorstudio/tetris@0.0.1: no such file or directory:

$ termcade add aviorstudio/tetris@0.0.1
termcade: versions cannot be pinned — `termcade add aviorstudio/tetris` installs what aviorstudio/tetris currently ships

That check runs before the account check — being told to sign in and then told the syntax changed is two trips for one mistake.

Tests

internal/registry had none, which was the wrong place for the gap: it is the trust boundary. It has five now, against a stub that answers the way the API does:

• a package arrives through the registry, with the session attached, and the GitHub URL resolve hands out is never fetched (the stub counts hits on it)
• a mismatched digest never reaches the disk, and leaves no temp file
• a missing digest is refused rather than trusted
• 401 surfaces as ErrLoginRequired, so callers can say "sign in" instead of "HTTP 401"
• resolve sends the ABI and no version

Verification

go vet clean, full suite passes after the rebase. Checked against a clean install: pinned syntax explains itself, a marketplace id asks for an account, and the bundled three still play with no network.

🤖 Generated with Claude Code