@skaile/workspaces 0.29.0 → 0.30.1

package/dist/{chunk-3QQSSRYN.js → chunk-5DQOZFWJ.js}

@@ -1,6 +1,6 @@
-import { decodeSkaileManifest, SKAILE_MANIFEST_FILENAME } from './chunk-IERB3UXJ.js';
-import { scanDirectory, parseFrontmatter, bundleDepRefs, fromMcpServerMd } from './chunk-2FS4FPZ7.js';
-import { parseAssetRef, assetRefToStr } from './chunk-IEJ5IOC3.js';
+import { decodeSkaileManifest, SKAILE_MANIFEST_FILENAME } from './chunk-H5YXL4KI.js';
+import { scanDirectory, parseFrontmatter, bundleDepRefs, fromMcpServerMd } from './chunk-4AGIEU7V.js';
+import { parseAssetRef, assetRefToStr } from './chunk-LFDZYCEO.js';
 import { mkdirSync, existsSync, readFileSync, writeFileSync, lstatSync, symlinkSync, rmSync, readdirSync, cpSync } from 'fs';
 import { homedir } from 'os';
 import { join, resolve, relative, dirname, parse as parse$1, basename } from 'path';
@@ -106,65 +106,75 @@ function unlinkRepo(projectDir, repoName) {
   return true;
 }
 function ensureRepo(decl, name, reposDir, opts) {
-  if (opts?.projectDir) {
-    const links = readLinks(opts.projectDir);
-    if (links[name]) {
-      const linked = links[name];
-      if (!existsSync(linked)) {
-        throw new Error(
-          `Linked path not found: ${linked}. Remove the .skaile/links.yaml entry to clear it.`
-        );
-      }
-      return linked;
-    }
-  }
+  const linked = resolveLinkedOverride(name, opts?.projectDir);
+  if (linked) return linked;
   if (decl.path) {
-    const projectDir = opts?.projectDir ?? resolve(reposDir, "..");
-    const resolved = resolve(projectDir, decl.path);
-    if (existsSync(resolved)) return resolved;
-    if (!decl.url) {
-      throw new Error(`Local repository path not found: ${decl.path} (resolved: ${resolved})`);
-    }
-    if (!cloneRepo(decl.url, decl.branch ?? "main", resolved)) {
-      throw new Error(`Failed to clone ${decl.url} into ${resolved}`);
-    }
-    if (opts?.pin) checkoutPin(resolved, opts.pin);
-    return resolved;
+    return ensureLocalPathRepo(decl, reposDir, opts);
   }
   if (decl.url) {
-    const branch = decl.branch ?? "main";
-    const globalCache = getGlobalCacheDir();
-    const cacheDest = join(globalCache, name);
-    if (existsSync(join(cacheDest, ".git"))) {
-      if (!opts?.pin) pullRepo(cacheDest, branch);
-    } else {
-      if (!cloneRepo(decl.url, branch, cacheDest)) {
-        throw new Error(`Failed to clone ${decl.url} (branch: ${branch})`);
-      }
+    return ensureRemoteRepo(decl, name, reposDir, opts);
+  }
+  throw new Error(`Repository "${name}" has neither url nor path`);
+}
+function resolveLinkedOverride(name, projectDir) {
+  if (!projectDir) return null;
+  const links = readLinks(projectDir);
+  const linked = links[name];
+  if (!linked) return null;
+  if (!existsSync(linked)) {
+    throw new Error(
+      `Linked path not found: ${linked}. Remove the .skaile/links.yaml entry to clear it.`
+    );
+  }
+  return linked;
+}
+function ensureLocalPathRepo(decl, reposDir, opts) {
+  const projectDir = opts?.projectDir ?? resolve(reposDir, "..");
+  const resolved = resolve(projectDir, decl.path);
+  if (existsSync(resolved)) return resolved;
+  if (!decl.url) {
+    throw new Error(`Local repository path not found: ${decl.path} (resolved: ${resolved})`);
+  }
+  if (!cloneRepo(decl.url, decl.branch ?? "main", resolved)) {
+    throw new Error(`Failed to clone ${decl.url} into ${resolved}`);
+  }
+  if (opts?.pin) checkoutPin(resolved, opts.pin);
+  return resolved;
+}
+function ensureRemoteRepo(decl, name, reposDir, opts) {
+  const branch = decl.branch ?? "main";
+  const globalCache = getGlobalCacheDir();
+  const cacheDest = join(globalCache, name);
+  if (existsSync(join(cacheDest, ".git"))) {
+    if (!opts?.pin) pullRepo(cacheDest, branch);
+  } else {
+    if (!cloneRepo(decl.url, branch, cacheDest)) {
+      throw new Error(`Failed to clone ${decl.url} (branch: ${branch})`);
     }
-    if (opts?.pin) {
-      checkoutPin(cacheDest, opts.pin);
+  }
+  if (opts?.pin) {
+    checkoutPin(cacheDest, opts.pin);
+  }
+  linkCacheIntoProject(cacheDest, reposDir, name);
+  return cacheDest;
+}
+function linkCacheIntoProject(cacheDest, reposDir, name) {
+  const projectDest = join(reposDir, name);
+  const projectExists = existsSync(projectDest);
+  const isSymlink = projectExists && lstatSync(projectDest).isSymbolicLink();
+  if (!projectExists) {
+    mkdirSync(reposDir, { recursive: true });
+    try {
+      symlinkSync(cacheDest, projectDest);
+    } catch {
     }
-    const projectDest = join(reposDir, name);
-    const projectExists = existsSync(projectDest);
-    const isSymlink = projectExists && lstatSync(projectDest).isSymbolicLink();
-    if (!projectExists) {
-      mkdirSync(reposDir, { recursive: true });
-      try {
-        symlinkSync(cacheDest, projectDest);
-      } catch {
-        return cacheDest;
-      }
-    } else if (!isSymlink) {
-      rmSync(projectDest, { recursive: true });
-      try {
-        symlinkSync(cacheDest, projectDest);
-      } catch {
-      }
+  } else if (!isSymlink) {
+    rmSync(projectDest, { recursive: true });
+    try {
+      symlinkSync(cacheDest, projectDest);
+    } catch {
     }
-    return cacheDest;
   }
-  throw new Error(`Repository "${name}" has neither url nor path`);
 }
 function repoSlugFromGitRemote(rootDir) {
   const r = spawnSync("git", ["-C", rootDir, "config", "--get", "remote.origin.url"], {
@@ -291,37 +301,7 @@ async function resolveAll(deps, opts) {
     if (seen.has(key)) return;
     seen.add(key);
     const sourceCandidates = opts.provenanceIndex.get(key) ?? [];
-    const storeCandidates = [];
-    if (opts.stores.length > 0 && opts.storeFetcher) {
-      const sourceVersions = sourceCandidates.map((c) => c.version);
-      const fetcher = opts.storeFetcher;
-      for (const store of opts.stores) {
-        let versionsHint = sourceVersions;
-        if (versionsHint.length === 0 && needsStoreVersionDiscovery(ref.pin) && fetcher.listVersions) {
-          versionsHint = await fetcher.listVersions(
-            store.url,
-            assetRefToStr({ ...ref, pin: void 0 })
-          );
-        }
-        const candidateVersions = enumerateVersionsForPin(ref.pin, versionsHint);
-        for (const v of candidateVersions) {
-          if (!v) continue;
-          const m = await fetcher.getInstallManifest(store.url, assetRefToStr({ ...ref, pin: v }));
-          if (m) {
-            storeCandidates.push({
-              publisher: ref.publisher,
-              kind: ref.kind,
-              name: ref.name,
-              version: v,
-              sourceUrl: m.sourceUrl,
-              commit: m.commit,
-              files: m.files,
-              sha256: m.sha256
-            });
-          }
-        }
-      }
-    }
+    const storeCandidates = await gatherStoreCandidates(ref, ref.publisher, sourceCandidates, opts);
     const all = [...sourceCandidates, ...storeCandidates];
     if (all.length === 0) {
       missing.push(refStr);
@@ -336,36 +316,23 @@ async function resolveAll(deps, opts) {
     const best = versions.sort((a, b) => semver.rcompare(coerceVersion(a), coerceVersion(b)))[0];
     const finalists = filtered.filter((c) => c.version === best);
     const canonicalRef = assetRefToStr({ ...ref, pin: best });
-    const uniqueShas = Array.from(new Set(finalists.map((c) => c.sha256)));
-    let chosen;
-    if (uniqueShas.length > 1) {
-      const override = overridesByRef.get(canonicalRef);
-      if (!override) {
-        throw new CanonicalRefConflictError(canonicalRef, finalists, [...depChain, refStr]);
-      }
-      const pick = finalists.find((c) => c.sourceUrl === override.source);
-      if (!pick) {
-        throw new Error(
-          `override for ${canonicalRef} points at ${override.source}, which is not among the resolved candidates`
-        );
-      }
-      chosen = pick;
-      overridesApplied.add(canonicalRef);
-    } else {
-      chosen = [...finalists].sort((a, b) => a.sourceUrl.localeCompare(b.sourceUrl))[0];
-    }
-    if (opts.storeFetcher && opts.stores.length > 0 && sourceCandidates.some((c) => c.version === best) && storeCandidates.some((c) => c.version === best)) {
-      for (const store of opts.stores) {
-        const d = await opts.storeFetcher.getCanonicalDigest(store.url, canonicalRef);
-        if (d && d.sha256 !== chosen.sha256) {
-          throw new CanonicalRefConflictError(
-            canonicalRef,
-            [...finalists, { ...chosen, sourceUrl: store.url, sha256: d.sha256 }],
-            [...depChain, refStr]
-          );
-        }
-      }
-    }
+    const chosen = selectChosenCandidate(
+      finalists,
+      canonicalRef,
+      overridesByRef,
+      overridesApplied,
+      [...depChain, refStr]
+    );
+    await crossCheckStoreDigest(
+      chosen,
+      finalists,
+      canonicalRef,
+      best,
+      sourceCandidates,
+      storeCandidates,
+      opts,
+      [...depChain, refStr]
+    );
     resolved.push(chosen);
     resolvedBy.set(key, parent);
     for (const depRef of chosen.deps ?? []) {
@@ -377,6 +344,72 @@ async function resolveAll(deps, opts) {
   }
   return { resolved, missing, resolvedBy, overridesApplied };
 }
+async function gatherStoreCandidates(ref, publisher, sourceCandidates, opts) {
+  const storeCandidates = [];
+  if (opts.stores.length === 0 || !opts.storeFetcher) return storeCandidates;
+  const sourceVersions = sourceCandidates.map((c) => c.version);
+  const fetcher = opts.storeFetcher;
+  for (const store of opts.stores) {
+    let versionsHint = sourceVersions;
+    if (versionsHint.length === 0 && needsStoreVersionDiscovery(ref.pin) && fetcher.listVersions) {
+      versionsHint = await fetcher.listVersions(
+        store.url,
+        assetRefToStr({ ...ref, pin: void 0 })
+      );
+    }
+    const candidateVersions = enumerateVersionsForPin(ref.pin, versionsHint);
+    for (const v of candidateVersions) {
+      if (!v) continue;
+      const m = await fetcher.getInstallManifest(store.url, assetRefToStr({ ...ref, pin: v }));
+      if (m) {
+        storeCandidates.push({
+          publisher,
+          kind: ref.kind,
+          name: ref.name,
+          version: v,
+          sourceUrl: m.sourceUrl,
+          commit: m.commit,
+          files: m.files,
+          sha256: m.sha256
+        });
+      }
+    }
+  }
+  return storeCandidates;
+}
+function selectChosenCandidate(finalists, canonicalRef, overridesByRef, overridesApplied, conflictChain) {
+  const uniqueShas = Array.from(new Set(finalists.map((c) => c.sha256)));
+  if (uniqueShas.length > 1) {
+    const override = overridesByRef.get(canonicalRef);
+    if (!override) {
+      throw new CanonicalRefConflictError(canonicalRef, finalists, conflictChain);
+    }
+    const pick = finalists.find((c) => c.sourceUrl === override.source);
+    if (!pick) {
+      throw new Error(
+        `override for ${canonicalRef} points at ${override.source}, which is not among the resolved candidates`
+      );
+    }
+    overridesApplied.add(canonicalRef);
+    return pick;
+  }
+  return [...finalists].sort((a, b) => a.sourceUrl.localeCompare(b.sourceUrl))[0];
+}
+async function crossCheckStoreDigest(chosen, finalists, canonicalRef, best, sourceCandidates, storeCandidates, opts, conflictChain) {
+  if (!opts.storeFetcher || opts.stores.length === 0 || !sourceCandidates.some((c) => c.version === best) || !storeCandidates.some((c) => c.version === best)) {
+    return;
+  }
+  for (const store of opts.stores) {
+    const d = await opts.storeFetcher.getCanonicalDigest(store.url, canonicalRef);
+    if (d && d.sha256 !== chosen.sha256) {
+      throw new CanonicalRefConflictError(
+        canonicalRef,
+        [...finalists, { ...chosen, sourceUrl: store.url, sha256: d.sha256 }],
+        conflictChain
+      );
+    }
+  }
+}
 function coerceVersion(v) {
   return semver.valid(v) ? v : semver.coerce(v)?.version ?? "0.0.0";
 }
@@ -534,51 +567,57 @@ function walkWithManifest(clone, manifestPath, index) {
     }
     const curatedSource = a.source ?? manifest.source;
     const version = a.version ?? manifestVersion;
-    let files;
-    let sourceUrl;
-    let commit;
-    let metadata;
-    let frontmatter;
-    if (curatedSource) {
-      files = granularFiles(a) ?? [];
-      sourceUrl = curatedSource.url;
-      commit = curatedSource.commit ?? clone.commit;
-    } else {
-      files = expandAssetFiles(repoRoot, a);
-      verifyNameMatch(repoRoot, files, a.name, a.kind);
-      metadata = readMetadata(repoRoot, files, a.kind);
-      frontmatter = readContentFrontmatter(repoRoot, files, a.kind);
-      sourceUrl = clone.sourceUrl;
-      commit = clone.commit;
-    }
+    const resolved = resolveAssetBytes(clone, repoRoot, a, curatedSource);
+    const { files } = resolved;
     const candidate = {
       publisher: assetPublisher,
       kind: a.kind,
       name: a.name,
       version,
-      sourceUrl,
-      commit,
+      sourceUrl: resolved.sourceUrl,
+      commit: resolved.commit,
       files,
       sha256: a.sha256 ?? compositeSha256(files),
-      metadata,
+      metadata: resolved.metadata,
       deps: a.dependencies ?? bundleDeps(repoRoot, files, a.kind)
     };
-    const fmStr = (k) => typeof frontmatter?.[k] === "string" ? frontmatter[k] : void 0;
-    const fmArr = (k) => Array.isArray(frontmatter?.[k]) ? frontmatter[k].filter((x) => typeof x === "string") : void 0;
-    const description = a.description ?? fmStr("description");
-    const keywords = a.keywords ?? fmArr("keywords");
-    const category = a.category ?? fmStr("category");
-    const license = a.license ?? manifest.license;
-    const homepage = a.homepage ?? manifest.homepage;
-    if (description) candidate.description = description;
-    if (keywords && keywords.length > 0) candidate.keywords = keywords;
-    if (category) candidate.category = category;
-    if (license) candidate.license = license;
-    if (homepage) candidate.homepage = homepage;
+    applyStoreListingMetadata(candidate, a, manifest, resolved.frontmatter);
     push(index, `${assetPublisher}/${a.kind}:${a.name}`, candidate);
   }
   return true;
 }
+function resolveAssetBytes(clone, repoRoot, a, curatedSource) {
+  if (curatedSource) {
+    return {
+      files: granularFiles(a) ?? [],
+      sourceUrl: curatedSource.url,
+      commit: curatedSource.commit ?? clone.commit
+    };
+  }
+  const files = expandAssetFiles(repoRoot, a);
+  verifyNameMatch(repoRoot, files, a.name, a.kind);
+  return {
+    files,
+    sourceUrl: clone.sourceUrl,
+    commit: clone.commit,
+    metadata: readMetadata(repoRoot, files, a.kind),
+    frontmatter: readContentFrontmatter(repoRoot, files, a.kind)
+  };
+}
+function applyStoreListingMetadata(candidate, a, manifest, frontmatter) {
+  const fmStr = (k) => typeof frontmatter?.[k] === "string" ? frontmatter[k] : void 0;
+  const fmArr = (k) => Array.isArray(frontmatter?.[k]) ? frontmatter[k].filter((x) => typeof x === "string") : void 0;
+  const description = a.description ?? fmStr("description");
+  const keywords = a.keywords ?? fmArr("keywords");
+  const category = a.category ?? fmStr("category");
+  const license = a.license ?? manifest.license;
+  const homepage = a.homepage ?? manifest.homepage;
+  if (description) candidate.description = description;
+  if (keywords && keywords.length > 0) candidate.keywords = keywords;
+  if (category) candidate.category = category;
+  if (license) candidate.license = license;
+  if (homepage) candidate.homepage = homepage;
+}
 function globFiles(a) {
   if (!Array.isArray(a.files)) return void 0;
   const strings = a.files.filter((f) => typeof f === "string");
@@ -854,59 +893,8 @@ function mergeSkWorkspaceConfigs(base, overlay) {
     connectors: mergeById(base.connectors ?? [], overlay.connectors ?? []),
     // mcp_servers: by id — overlay wins
     mcp_servers: mergeById(base.mcp_servers ?? [], overlay.mcp_servers ?? []),
-    agent: {
-      definition: overlay.agent?.definition ?? base.agent?.definition,
-      context: overlay.agent?.context ?? base.agent?.context,
-      permissions: {
-        ...base.agent?.permissions,
-        ...stripUndefined(overlay.agent?.permissions),
-        deny_write: dedupe([
-          ...base.agent?.permissions?.deny_write ?? [],
-          ...overlay.agent?.permissions?.deny_write ?? []
-        ]),
-        deny_read: dedupe([
-          ...base.agent?.permissions?.deny_read ?? [],
-          ...overlay.agent?.permissions?.deny_read ?? []
-        ])
-      },
-      subagents: {
-        ...base.agent?.subagents ?? {},
-        ...overlay.agent?.subagents ?? {}
-      },
-      hooks: {
-        pre_flow: [
-          ...base.agent?.hooks?.pre_flow ?? [],
-          ...overlay.agent?.hooks?.pre_flow ?? []
-        ],
-        post_flow: [
-          ...base.agent?.hooks?.post_flow ?? [],
-          ...overlay.agent?.hooks?.post_flow ?? []
-        ],
-        pre_node: [
-          ...base.agent?.hooks?.pre_node ?? [],
-          ...overlay.agent?.hooks?.pre_node ?? []
-        ],
-        post_node: [
-          ...base.agent?.hooks?.post_node ?? [],
-          ...overlay.agent?.hooks?.post_node ?? []
-        ]
-      }
-    },
-    workspace: {
-      directories: dedupe([
-        ...base.workspace?.directories ?? [],
-        ...overlay.workspace?.directories ?? []
-      ]),
-      git: {
-        init: overlay.workspace?.git?.init ?? base.workspace?.git?.init,
-        ignore: dedupe([
-          ...base.workspace?.git?.ignore ?? [],
-          ...overlay.workspace?.git?.ignore ?? []
-        ])
-      },
-      setup: overlay.workspace?.setup ?? base.workspace?.setup,
-      container: overlay.workspace?.container ?? base.workspace?.container
-    },
+    agent: mergeAgentConfig(base.agent, overlay.agent),
+    workspace: mergeWorkspaceConfig(base.workspace, overlay.workspace),
     // secrets: overlay wins entirely
     secrets: overlay.secrets ?? base.secrets,
     // telemetry: overlay wins entirely (raw pass-through)
@@ -925,6 +913,45 @@ function mergeSkWorkspaceConfigs(base, overlay) {
     deploy: overlay.deploy ?? base.deploy
   };
 }
+function mergeAgentConfig(base, overlay) {
+  return {
+    definition: overlay?.definition ?? base?.definition,
+    context: overlay?.context ?? base?.context,
+    permissions: {
+      ...base?.permissions,
+      ...stripUndefined(overlay?.permissions),
+      deny_write: dedupe([
+        ...base?.permissions?.deny_write ?? [],
+        ...overlay?.permissions?.deny_write ?? []
+      ]),
+      deny_read: dedupe([
+        ...base?.permissions?.deny_read ?? [],
+        ...overlay?.permissions?.deny_read ?? []
+      ])
+    },
+    subagents: {
+      ...base?.subagents ?? {},
+      ...overlay?.subagents ?? {}
+    },
+    hooks: {
+      pre_flow: [...base?.hooks?.pre_flow ?? [], ...overlay?.hooks?.pre_flow ?? []],
+      post_flow: [...base?.hooks?.post_flow ?? [], ...overlay?.hooks?.post_flow ?? []],
+      pre_node: [...base?.hooks?.pre_node ?? [], ...overlay?.hooks?.pre_node ?? []],
+      post_node: [...base?.hooks?.post_node ?? [], ...overlay?.hooks?.post_node ?? []]
+    }
+  };
+}
+function mergeWorkspaceConfig(base, overlay) {
+  return {
+    directories: dedupe([...base?.directories ?? [], ...overlay?.directories ?? []]),
+    git: {
+      init: overlay?.git?.init ?? base?.git?.init,
+      ignore: dedupe([...base?.git?.ignore ?? [], ...overlay?.git?.ignore ?? []])
+    },
+    setup: overlay?.setup ?? base?.setup,
+    container: overlay?.container ?? base?.container
+  };
+}
 var KNOWN_DRIVERS = ["omp", "claude-sdk", "codex"];
 var KNOWN_PROVIDERS = [
   "anthropic",
@@ -958,11 +985,7 @@ function normalizeAgentConfig(raw) {
 function normalizeConfig(raw) {
   return normalizeConfigInternal(raw).config;
 }
-function normalizeConfigInternal(raw) {
-  const config = {};
-  const diagnostics = [];
-  if (raw.name) config.name = String(raw.name);
-  if (raw.description) config.description = String(raw.description);
+function normalizeAgentConfigSection(raw, config, diagnostics) {
   let agentConfigRaw;
   let agentConfigKey;
   if (raw["agent-config"] !== void 0) {
@@ -975,31 +998,29 @@ function normalizeConfigInternal(raw) {
     agentConfigRaw = raw.agentConfig;
     agentConfigKey = "agentConfig";
   }
-  if (agentConfigRaw && typeof agentConfigRaw === "object" && !Array.isArray(agentConfigRaw)) {
-    if (agentConfigKey === "agentConfig") {
-      diagnostics.push({
-        code: "legacy_key_camelcase",
-        severity: "warning",
-        message: 'Non-canonical key "agentConfig" \u2014 use "agent-config".',
-        path: "agentConfig"
-      });
-    }
-    const { profiles, wrappedFlat } = normalizeAgentConfig(
-      agentConfigRaw
-    );
-    if (wrappedFlat) {
-      diagnostics.push({
-        code: "legacy_agent_config_flat",
-        severity: "warning",
-        message: 'Flat agent-config block wrapped as the "default" profile \u2014 nest fields under "default:".',
-        path: agentConfigKey
-      });
-    }
-    config.agent_config = profiles;
+  if (!agentConfigRaw || typeof agentConfigRaw !== "object" || Array.isArray(agentConfigRaw)) {
+    return;
   }
-  if (Array.isArray(raw.startup)) {
-    config.startup = raw.startup;
+  if (agentConfigKey === "agentConfig") {
+    diagnostics.push({
+      code: "legacy_key_camelcase",
+      severity: "warning",
+      message: 'Non-canonical key "agentConfig" \u2014 use "agent-config".',
+      path: "agentConfig"
+    });
+  }
+  const { profiles, wrappedFlat } = normalizeAgentConfig(agentConfigRaw);
+  if (wrappedFlat) {
+    diagnostics.push({
+      code: "legacy_agent_config_flat",
+      severity: "warning",
+      message: 'Flat agent-config block wrapped as the "default" profile \u2014 nest fields under "default:".',
+      path: agentConfigKey
+    });
   }
+  config.agent_config = profiles;
+}
+function assertNoLegacyTopLevelKeys(raw) {
   if (raw.repositories !== void 0) {
     throw new Error(
       "skaile.yaml: unknown top-level key `repositories:`. The schema changed \u2014 see docs/concepts/manifest-schema.md, or ask your AI assistant to apply the `migrate-skaile-manifest` skill."
@@ -1017,37 +1038,49 @@ function normalizeConfigInternal(raw) {
       );
     }
   }
-  if (Array.isArray(raw.stores)) {
-    const entries = [];
-    for (const item of raw.stores) {
-      if (!item || typeof item !== "object" || Array.isArray(item)) continue;
-      const s = item;
-      const url = typeof s.url === "string" ? s.url : "";
-      if (!url) continue;
-      entries.push({ url });
-    }
-    if (entries.length > 0) config.stores = entries;
+}
+function normalizeOverrideEntry(item) {
+  if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+  const o = item;
+  const ref = typeof o.ref === "string" ? o.ref : "";
+  const source = typeof o.source === "string" ? o.source : "";
+  if (!ref || !source) return null;
+  if (typeof o.reason !== "string") {
+    throw new Error(
+      `skaile.yaml: overrides[] entry for ${ref}: reason is required and must be a non-empty string.`
+    );
   }
-  if (Array.isArray(raw.overrides)) {
-    const entries = [];
-    for (const item of raw.overrides) {
-      if (!item || typeof item !== "object" || Array.isArray(item)) continue;
-      const o = item;
-      const ref = typeof o.ref === "string" ? o.ref : "";
-      const source = typeof o.source === "string" ? o.source : "";
-      if (!ref || !source) continue;
-      if (typeof o.reason !== "string") {
-        throw new Error(
-          `skaile.yaml: overrides[] entry for ${ref}: reason is required and must be a non-empty string.`
-        );
-      }
-      if (o.reason.trim().length === 0) {
-        throw new Error(`skaile.yaml: overrides[] entry for ${ref}: reason must not be empty.`);
-      }
-      entries.push({ ref, source, reason: o.reason });
-    }
-    if (entries.length > 0) config.overrides = entries;
+  if (o.reason.trim().length === 0) {
+    throw new Error(`skaile.yaml: overrides[] entry for ${ref}: reason must not be empty.`);
   }
+  return { ref, source, reason: o.reason };
+}
+function normalizeStoresSection(raw, config) {
+  if (!Array.isArray(raw.stores)) return;
+  const entries = [];
+  for (const item of raw.stores) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const s = item;
+    const url = typeof s.url === "string" ? s.url : "";
+    if (!url) continue;
+    entries.push({ url });
+  }
+  if (entries.length > 0) config.stores = entries;
+}
+function normalizeOverridesSection(raw, config) {
+  if (!Array.isArray(raw.overrides)) return;
+  const entries = [];
+  for (const item of raw.overrides) {
+    const entry = normalizeOverrideEntry(item);
+    if (entry) entries.push(entry);
+  }
+  if (entries.length > 0) config.overrides = entries;
+}
+function normalizeConsumptionSection(raw, config) {
+  normalizeStoresSection(raw, config);
+  normalizeOverridesSection(raw, config);
+}
+function normalizeStructuralSections(raw, config) {
   if (Array.isArray(raw.mounts)) {
     config.mounts = raw.mounts;
   }
@@ -1079,6 +1112,8 @@ function normalizeConfigInternal(raw) {
   if (raw.patches && typeof raw.patches === "object" && !Array.isArray(raw.patches)) {
     config.patches = raw.patches;
   }
+}
+function normalizeDependencySection(raw, config) {
   if (Array.isArray(raw.dependencies)) {
     config.dependencies = raw.dependencies.filter((d) => typeof d === "string");
   }
@@ -1098,6 +1133,20 @@ function normalizeConfigInternal(raw) {
   if (raw.telemetry && typeof raw.telemetry === "object" && !Array.isArray(raw.telemetry)) {
     config.telemetry = raw.telemetry;
   }
+}
+function normalizeConfigInternal(raw) {
+  const config = {};
+  const diagnostics = [];
+  if (raw.name) config.name = String(raw.name);
+  if (raw.description) config.description = String(raw.description);
+  normalizeAgentConfigSection(raw, config, diagnostics);
+  if (Array.isArray(raw.startup)) {
+    config.startup = raw.startup;
+  }
+  assertNoLegacyTopLevelKeys(raw);
+  normalizeConsumptionSection(raw, config);
+  normalizeStructuralSections(raw, config);
+  normalizeDependencySection(raw, config);
   return { config, diagnostics };
 }
 function decodeSkaileYaml(text) {
@@ -1293,30 +1342,33 @@ function mcpDeclFromCatalogEntry(entry) {
   }
   if (entry.description) decl.description = entry.description;
   if (m.recipe && typeof m.recipe === "object" && !Array.isArray(m.recipe)) {
-    const r = m.recipe;
-    const hasFlake = typeof r.flake === "string";
-    const rawAttr = typeof r.attr === "string" ? r.attr : void 0;
-    const effectiveAttr = rawAttr ?? (hasFlake ? DEFAULT_RECIPE_ATTR : void 0);
-    if (effectiveAttr !== void 0) {
-      try {
-        validateAssetRecipeAttr(effectiveAttr);
-        if (hasFlake) {
-          validateAssetRecipeFlake(r.flake);
-          decl.recipe = { attr: effectiveAttr, flake: r.flake };
-          if (typeof r.publisher === "string") decl.recipe.publisher = r.publisher;
-        } else {
-          decl.recipe = { attr: effectiveAttr };
-        }
-      } catch (err) {
-        console.warn(
-          `[workspace-config] mcpDeclFromCatalogEntry: invalid recipe for entry "${entry.name}": ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
+    const recipe = parseCatalogRecipe(m.recipe, entry.name);
+    if (recipe) decl.recipe = recipe;
   }
   if (!decl.command && !decl.url) return null;
   return decl;
 }
+function parseCatalogRecipe(r, entryName) {
+  const hasFlake = typeof r.flake === "string";
+  const rawAttr = typeof r.attr === "string" ? r.attr : void 0;
+  const effectiveAttr = rawAttr ?? (hasFlake ? DEFAULT_RECIPE_ATTR : void 0);
+  if (effectiveAttr === void 0) return null;
+  try {
+    validateAssetRecipeAttr(effectiveAttr);
+    if (hasFlake) {
+      validateAssetRecipeFlake(r.flake);
+      const recipe = { attr: effectiveAttr, flake: r.flake };
+      if (typeof r.publisher === "string") recipe.publisher = r.publisher;
+      return recipe;
+    }
+    return { attr: effectiveAttr };
+  } catch (err) {
+    console.warn(
+      `[workspace-config] mcpDeclFromCatalogEntry: invalid recipe for entry "${entryName}": ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
 function mergeMcpDeclarations(base, overlay) {
   return {
     id: overlay.id,
@@ -1332,6 +1384,28 @@ function mergeMcpDeclarations(base, overlay) {
   };
 }
 var unscopedTail = (x) => x.includes("/") ? x.split("/").pop() : x;
+function foldInstanceEnv(decl, instancePath, name) {
+  if (!existsSync(instancePath)) return;
+  try {
+    const instance = JSON.parse(readFileSync(instancePath, "utf8"));
+    const env = { ...decl.env ?? {} };
+    if (instance.config && typeof instance.config === "object") {
+      for (const [k, v] of Object.entries(instance.config)) {
+        if (typeof v === "string") env[k] = v;
+      }
+    }
+    if (instance.resolvedSecrets && typeof instance.resolvedSecrets === "object") {
+      for (const [k, v] of Object.entries(instance.resolvedSecrets)) {
+        if (typeof v === "string") env[k] = v;
+      }
+    }
+    if (Object.keys(env).length > 0) decl.env = env;
+  } catch (err) {
+    console.warn(
+      `[workspace-config] loadMaterializedMcpDeclarations: ignoring malformed ".instance.json" for "${name}": ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
 function loadMaterializedMcpDeclarations(projectDir) {
   const dir = join(projectDir, ".skaile/assets/mcp-server");
   if (!existsSync(dir)) return [];
@@ -1351,28 +1425,7 @@ function loadMaterializedMcpDeclarations(projectDir) {
       const decl = mcpDeclFromCatalogEntry(entry);
       if (!decl) continue;
       decl.id = entry.name || name;
-      const instancePath = join(subDir, ".instance.json");
-      if (existsSync(instancePath)) {
-        try {
-          const instance = JSON.parse(readFileSync(instancePath, "utf8"));
-          const env = { ...decl.env ?? {} };
-          if (instance.config && typeof instance.config === "object") {
-            for (const [k, v] of Object.entries(instance.config)) {
-              if (typeof v === "string") env[k] = v;
-            }
-          }
-          if (instance.resolvedSecrets && typeof instance.resolvedSecrets === "object") {
-            for (const [k, v] of Object.entries(instance.resolvedSecrets)) {
-              if (typeof v === "string") env[k] = v;
-            }
-          }
-          if (Object.keys(env).length > 0) decl.env = env;
-        } catch (err) {
-          console.warn(
-            `[workspace-config] loadMaterializedMcpDeclarations: ignoring malformed ".instance.json" for "${name}": ${err instanceof Error ? err.message : String(err)}`
-          );
-        }
-      }
+      foldInstanceEnv(decl, join(subDir, ".instance.json"), name);
       result.push(decl);
     } catch (err) {
       console.warn(
@@ -1450,31 +1503,49 @@ function catalogEntryFromCandidate(c) {
   if (c.homepage != null) entry.homepage = c.homepage;
   return entry;
 }
-function loadMcpServerDeclarations(projectDir) {
-  const config = resolveSkWorkspaceConfig(projectDir);
-  const explicit = config.mcp_servers ?? [];
-  const materialized = loadMaterializedMcpDeclarations(projectDir);
+function lookupMcpCandidate(provenanceIndex, ref) {
+  let candidates;
+  if (ref.publisher) {
+    candidates = provenanceIndex.get(`${ref.publisher}/${ref.kind}:${ref.name}`);
+  }
+  if (!candidates) {
+    for (const [key, arr] of provenanceIndex) {
+      if (key.endsWith(`/${ref.kind}:${ref.name}`)) {
+        candidates = arr;
+        break;
+      }
+    }
+  }
+  return candidates?.[0];
+}
+function buildDeclaredMcpNames(explicit, mcpRefStrings) {
+  return /* @__PURE__ */ new Set([
+    ...explicit.flatMap((e) => [e.id, unscopedTail(e.id)]),
+    ...mcpRefStrings.flatMap((refStr) => {
+      try {
+        const r = parseAssetRef(refStr);
+        return [r.name, unscopedTail(r.name)];
+      } catch {
+        return [];
+      }
+    })
+  ]);
+}
+function collectMcpRefStrings(dependencies) {
   const mcpRefStrings = [];
-  for (const dep of config.dependencies ?? []) {
+  for (const dep of dependencies ?? []) {
     try {
       const ref = parseAssetRef(dep);
       if (ref.kind === "mcp-server") mcpRefStrings.push(dep);
     } catch {
     }
   }
-  const sources = config.sources ?? [];
-  const provenanceIndex = sources.length > 0 ? buildProvenanceIndex(buildSourceClones(sources)) : /* @__PURE__ */ new Map();
-  const byId = /* @__PURE__ */ new Map();
-  const order = [];
-  const upsert = (decl) => {
-    const existing = byId.get(decl.id);
-    if (existing) {
-      byId.set(decl.id, mergeMcpDeclarations(existing, decl));
-    } else {
-      byId.set(decl.id, decl);
-      order.push(decl.id);
-    }
-  };
+  return mcpRefStrings;
+}
+function buildMcpProvenanceIndex(sources, projectDir) {
+  return sources.length > 0 ? buildProvenanceIndex(buildSourceClones(sources)) : /* @__PURE__ */ new Map();
+}
+function upsertCatalogMcpDecls(mcpRefStrings, provenanceIndex, upsert) {
   const seen = /* @__PURE__ */ new Set();
   for (const refStr of mcpRefStrings) {
     let ref;
@@ -1485,37 +1556,16 @@ function loadMcpServerDeclarations(projectDir) {
     }
     if (seen.has(ref.name)) continue;
     seen.add(ref.name);
-    let candidates;
-    if (ref.publisher) {
-      candidates = provenanceIndex.get(`${ref.publisher}/${ref.kind}:${ref.name}`);
-    }
-    if (!candidates) {
-      for (const [key, arr] of provenanceIndex) {
-        if (key.endsWith(`/${ref.kind}:${ref.name}`)) {
-          candidates = arr;
-          break;
-        }
-      }
-    }
-    const candidate = candidates?.[0];
+    const candidate = lookupMcpCandidate(provenanceIndex, ref);
     if (!candidate) continue;
     const catalogDecl = mcpDeclFromCatalogEntry(catalogEntryFromCandidate(candidate));
     if (!catalogDecl) continue;
     upsert(catalogDecl);
   }
-  const strictYaml = process.env.SKAILE_STRICT_YAML === "true";
+}
+function upsertMaterializedMcpDecls(materialized, explicit, mcpRefStrings, strictYaml, upsert) {
   if (strictYaml) {
-    const declaredNames = /* @__PURE__ */ new Set([
-      ...explicit.flatMap((e) => [e.id, unscopedTail(e.id)]),
-      ...mcpRefStrings.flatMap((refStr) => {
-        try {
-          const r = parseAssetRef(refStr);
-          return [r.name, unscopedTail(r.name)];
-        } catch {
-          return [];
-        }
-      })
-    ]);
+    const declaredNames = buildDeclaredMcpNames(explicit, mcpRefStrings);
     for (const decl of materialized) {
       if (declaredNames.has(decl.id) || declaredNames.has(unscopedTail(decl.id))) upsert(decl);
     }
@@ -1524,6 +1574,27 @@ function loadMcpServerDeclarations(projectDir) {
       upsert(decl);
     }
   }
+}
+function loadMcpServerDeclarations(projectDir) {
+  const config = resolveSkWorkspaceConfig(projectDir);
+  const explicit = config.mcp_servers ?? [];
+  const materialized = loadMaterializedMcpDeclarations(projectDir);
+  const mcpRefStrings = collectMcpRefStrings(config.dependencies);
+  const provenanceIndex = buildMcpProvenanceIndex(config.sources ?? []);
+  const byId = /* @__PURE__ */ new Map();
+  const order = [];
+  const upsert = (decl) => {
+    const existing = byId.get(decl.id);
+    if (existing) {
+      byId.set(decl.id, mergeMcpDeclarations(existing, decl));
+    } else {
+      byId.set(decl.id, decl);
+      order.push(decl.id);
+    }
+  };
+  upsertCatalogMcpDecls(mcpRefStrings, provenanceIndex, upsert);
+  const strictYaml = process.env.SKAILE_STRICT_YAML === "true";
+  upsertMaterializedMcpDecls(materialized, explicit, mcpRefStrings, strictYaml, upsert);
   for (const decl of explicit) {
     upsert(decl);
   }
@@ -1557,5 +1628,5 @@ function resolveAgentDir(projectDir) {
 }
 
 export { COMPACTION_DEFAULTS, CanonicalRefConflictError, DEFAULT_RECIPE_ATTR, SKAILE_YAML_DEFAULT, SKAILE_YAML_SUFFIX, SK_WORKSPACE_DEFAULT_NAME, SK_WORKSPACE_SUFFIX, buildProvenanceIndex, checkRepoStatus, checkoutPin, cloneRepo, decodeSkaileYaml, encodeSkaileYaml, ensureRepo, findWorkspaceRoot, getGlobalCacheDir, getRepoCommit, isWorkspaceConfigFilename, linkRepo, listSkWorkspaceConfigs, loadMcpServerDeclarations, loadSkWorkspaceConfig, mergeSkWorkspaceConfigs, normalizeConfig, pullRepo, readLinks, resolveAgentDir, resolveAll, resolveAsset, resolveSkWorkspaceConfig, saveSkWorkspaceConfig, scanRepo, stageMaterializedSkills, unlinkRepo, validateAssetRecipeAttr, validateAssetRecipeFlake, workspaceConfigFilename, workspaceNameFromFilename, writeLinks };
-//# sourceMappingURL=chunk-3QQSSRYN.js.map
-//# sourceMappingURL=chunk-3QQSSRYN.js.map
+//# sourceMappingURL=chunk-5DQOZFWJ.js.map
+//# sourceMappingURL=chunk-5DQOZFWJ.js.map