feat: mxcli marketplace package exports a module as a .mpk (closes #1382)

.claude/skills/mendix/download-marketplace-content/SKILL.md

@@ -37,6 +37,7 @@ These are **CLI commands**, not MDL statements.
 - User wants to upgrade a module that is already installed
 - User asks whether a marketplace module has been edited locally, or what an upgrade would overwrite
 - User asks to download a specific `.mpk` (e.g. for CI, or to import in Studio Pro)
+- User asks to export a module of their own project as a `.mpk`
 - User asks which versions of a marketplace item are compatible with their Mendix version
 - User reports `CE0463` or `CE6087` right after installing or updating a module
 
@@ -443,6 +444,28 @@ Four things this run established, none of them obvious from the command list:
 The ids are a convenience, not an authority: confirm with `search`/`info` rather than
 trusting them from memory, and note that the listing name never matches the module name.
 
+## Package a module of the project (`marketplace package`)
+
+The reverse of `install --file`: export a module as a `.mpk`. No PAT is needed.
+
+```bash
+mxcli marketplace package MyModule -p app.mpr                 # ./MyModule.mpk
+mxcli marketplace package MyModule -p app.mpr -o ./dist --json   # {path, sizeBytes, files, foreignEntries}
+mxcli marketplace install --file ./dist/MyModule.mpk -p other.mpr   # and back in
+```
+
+- Only the module's own required `userlib/` JARs go in; `--all-libs` bundles every JAR.
+- `mx` still exports the whole `resources/` folder (another module's `resources/EventLog/` came
+  along in a measured export). mxcli warns about each such file in `resources/`, `javasource/` or
+  `themesource/` and prints the `--exclude` pattern
+  that drops it, e.g. `--exclude '^resources.EventLog.'`. `--exclude` takes **one** regex (join
+  with `|`) and the separator must be written `.`: `[/\\]` makes `mx` write nothing.
+- The `mx` used must be the project's Mendix version (read from the `mx` itself): a mismatch, or an
+  `mx` of unknown version, is refused with both versions named. Fix: `mxcli setup mxbuild --version X`
+  (an `mx` on PATH is used first). `--mxbuild-path` is the override: a mismatch then only warns on stderr.
+- `mx` writes into the project it is given, so mxcli runs it on a temporary copy; the project on
+  disk is unchanged. A Studio Pro lock file beside the project does not stop the export.
+
 ## Notes
 
 - `install`/`update`/`diff` require `-p <app.mpr>`; `download` does not.

CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Added
+
+- **`mxcli marketplace package` — export a module as a `.mpk`** (mendixlabs/mxcli#1382) — `mxcli marketplace package MyModule -p app.mpr [-o dir] [--all-libs] [--exclude REGEX] [--exclude-managed-dependencies] [--json]` is the reverse of `marketplace install --file`: it wraps Mendix's own `mx create-module-package` (resolved for the project's Mendix version), so the package is what Studio Pro's *Export module package* makes, and it installs back with `install --file`. By default only the module's own required `userlib/` JARs go in (`mx -l`; measured 12.5 KB against 24 MB with Business Events installed); `--all-libs` bundles every JAR. `-l` filters only JARs — mx still exports the app's whole `resources/` folder (measured: another module's `resources/EventLog/` came along) — so after the export mxcli opens the package, warns on stderr about each `resources/<X>/`, `javasource/<x>/` or `themesource/<x>/` file of another module, and prints the `--exclude` pattern that drops them in the one form mx accepts (`^resources.EventLog.`; a character class or backslash is rejected by mx with exit 1 and a usage message, and an exit 0 that wrote no package is reported as an error too). A module name that is not in the project lists the project's modules instead of failing with mx's exit 3, and mx's exit codes 1–4 are reported with what they mean and what mx printed. `mx create-module-package` writes into the project it is given — measured on a blank 11.12.5 app: `theme-cache/web/theme.compiled.css` and its map rewritten, `deployment/sass/main.scss` added, the module's `themesource/` folder created, model files untouched — so it runs on a temporary copy, as `docker check` does; a before/after listing of the project (sizes and modification times) was identical. The `mx` that runs must be the project's Mendix version: `ResolveMxForVersion` prefers an `mx` on PATH and falls back to any cached one, so mxcli reads the version of the `mx` it found (its `mx.deps.json`, else its version-named folder) and refuses a different major.minor.patch, or one it cannot identify, naming both versions and the fix (`mxcli setup mxbuild --version X`); `--mxbuild-path` is the override, with a warning on stderr. mx's own output on a successful export goes to stderr, cancelling the command stops mx, and an output directory inside the project is not copied into the temporary copy. Round trip on 11.12.5: export, `install --file` into a second fresh app, `mx check` — 0 errors.
+
 ## [0.27.0] - 2026-10-15
 
 Headline: **`exec` is all or nothing: when a statement fails at write time, the whole run is rolled back, so a script never leaves a project half-changed.** Alongside it: a wave of `describe` → `check` → `exec` fixes from round-trip runs over real apps (the Siemens FSM template, the GenAI showcase, Marketplace modules), Mendix 9 projects can take microflows, nanoflows and pluggable widgets again, `check -p` resolves many more of the references `exec` and the build would refuse, the classic `filemanager` widget and role-based `Visible: roles (…)` are in MDL, and the companion draws a module's domain model. The MongoDB driver is upgraded for the October 2026 BSON advisories.

cmd/mxcli/cmd_marketplace.go

@@ -28,7 +28,9 @@ Requires a Personal Access Token (PAT). Run 'mxcli auth login' first.
 'marketplace download' fetches a content version's .mpk to disk;
 'marketplace install --file <package.mpk>' installs a .mpk from disk — a downloaded
 one, or any package distributed as a file — through the same writer as an online
-install, with no PAT.`,
+install, with no PAT.
+'marketplace package <module>' is the reverse: it exports a module of a project
+as a .mpk.`,
 }
 
 var marketplaceSearchCmd = &cobra.Command{