@skaile/workspaces 5.9.0 → 5.10.0

package/dist/{chunk-K3CVFRVS.js.map → chunk-JFXQEVLF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-publisher.ts"],"names":[],"mappings":";;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF","file":"chunk-K3CVFRVS.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n"]}
+{"version":3,"sources":["../cli/src/store-publisher.ts"],"names":[],"mappings":";;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF","file":"chunk-JFXQEVLF.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n"]}

package/dist/{chunk-JAKOMFC6.js → chunk-JZCSNEHK.js}

@@ -1,9 +1,9 @@
 import { globalCacheRoot, globalSkaileDir, mergeLegacyEntriesInto, mergeLegacyEntriesKeyed } from './chunk-L5VSIPQD.js';
 import { SUPPORTED_DRIVER_TARGETS, globalHarnessRoot } from './chunk-CPSIPIX7.js';
-import { decodeSkaileManifest, compositeSha256, listAssetFiles, SKAILE_MANIFEST_FILENAME, sha256Hex } from './chunk-BTE2V4IW.js';
+import { decodeSkaileManifest, compositeSha256, listAssetFiles, SKAILE_MANIFEST_FILENAME, sha256Hex } from './chunk-IXWODEED.js';
 import { readPluginGroupings } from './chunk-RVRB27AN.js';
-import { scanDirectory, parseFrontmatter, assetDepRefs, fromMcpServerMdContent, withFsDeadline, tryWithFsDeadline, fsDeadlineMs } from './chunk-GTILM2CI.js';
-import { isValidAssetName, slugifyAssetName, parseAssetRef, assetRefToStr } from './chunk-QVNRCDTV.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirementRefs, fromMcpServerMdContent, withFsDeadline, tryWithFsDeadline, fsDeadlineMs, assetDepRefs } from './chunk-Y34MSWEZ.js';
+import { isValidAssetName, slugifyAssetName, depToStr, parseAssetRef, assetRefToStr } from './chunk-4OV5DSBB.js';
 import { isRetentionValue } from './chunk-C3CAXQMA.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, lstatSync, symlinkSync, rmSync, readdirSync, constants, statSync } from 'fs';
 import { readdir, stat, cp, rm, open, readFile } from 'fs/promises';
@@ -11,7 +11,7 @@ import { join, posix, relative, resolve, dirname, sep, parse as parse$1, basenam
 import { parse, stringify } from 'yaml';
 import { spawnSync } from 'child_process';
 import { createHash } from 'crypto';
-import semver from 'semver';
+import semver2 from 'semver';
 import fg from 'fast-glob';
 
 // core/src/type-guards.ts
@@ -328,10 +328,11 @@ async function walkWithManifest(clone, manifestPath, index) {
       );
     }
     const curatedSource = a.source ?? manifest.source;
-    const version = a.version ?? manifestVersion;
+    const entryVersion = a.version ?? manifestVersion;
     const name = canonicalAssetName(a.name);
     const resolved = resolveAssetBytes(clone, repoRoot, a, curatedSource);
     const { files } = resolved;
+    const version = declaredFileVersion(resolved.frontmatter) ?? entryVersion;
     const candidate = {
       publisher: assetPublisher,
       kind: a.kind,
@@ -342,13 +343,21 @@ async function walkWithManifest(clone, manifestPath, index) {
       files,
       sha256: a.sha256 ?? compositeSha256(files),
       metadata: resolved.metadata,
-      ...a.dependencies ? { deps: a.dependencies } : await manifestDeps(repoRoot, files, a.kind)
+      ...await candidateDeps(repoRoot, files, a.kind, assetPublisher, a.dependencies)
     };
     applyStoreListingMetadata(candidate, a, manifest, resolved.frontmatter);
     push(index, `${assetPublisher}/${a.kind}:${name}`, candidate);
   }
   return true;
 }
+function declaredFileVersion(frontmatter) {
+  if (!frontmatter) return void 0;
+  const scalar = (v) => typeof v === "string" ? v : typeof v === "number" ? String(v) : void 0;
+  const meta = frontmatter.metadata;
+  const nested = meta !== null && typeof meta === "object" ? scalar(meta.version) : void 0;
+  const version = scalar(frontmatter.version) ?? nested;
+  return version !== void 0 && semver2.valid(version) ? version : void 0;
+}
 function canonicalAssetName(raw) {
   if (isValidAssetName(raw)) return raw;
   try {
@@ -453,7 +462,7 @@ async function walkFilenameConvention(clone, index, knownKinds) {
       files,
       sha256: compositeSha256(files),
       metadata: readMetadata(clone.localPath, files, e.kind),
-      ...await manifestDeps(clone.localPath, files, e.kind)
+      ...await candidateDeps(clone.localPath, files, e.kind, publisher)
     };
     push(index, `${publisher}/${e.kind}:${e.name}`, candidate);
   }
@@ -497,6 +506,14 @@ async function manifestDeps(repoRoot, files, kind) {
   const { refs, skipped } = await assetDepRefs(join(repoRoot, mf.path));
   return kind === "preset" ? { deps: refs, skippedItems: skipped } : { deps: refs };
 }
+async function candidateDeps(repoRoot, files, kind, publisher, explicit) {
+  const base = explicit ? { deps: explicit } : await manifestDeps(repoRoot, files, kind);
+  if (kind === "preset" || kind === "flow") return base;
+  const frontmatter = readContentFrontmatter(repoRoot, files, kind);
+  const declared = frontmatter ? parseRequires(frontmatter).map(depToStr) : [];
+  if (declared.length === 0) return base;
+  return { ...base, deps: dedupeRequirementRefs([...base.deps ?? [], ...declared], publisher) };
+}
 function push(index, key, candidate) {
   const arr = index.get(key) ?? [];
   arr.push(candidate);
@@ -576,6 +593,14 @@ function gitFailure(r) {
 }
 function pullRepoResult(dest, branch) {
   attachToBranch(dest, branch);
+  const ahead = spawnSync("git", ["-C", dest, "rev-list", "--count", `origin/${branch}..HEAD`], {
+    encoding: "utf8",
+    stdio: "pipe",
+    env: GIT_ENV
+  });
+  if (ahead.status === 0 && Number(ahead.stdout.trim()) > 0) {
+    return { ok: false, error: "Not possible to fast-forward, aborting." };
+  }
   const pull = spawnSync("git", ["-C", dest, "pull", "--depth=1", "--ff-only"], {
     stdio: "pipe",
     env: GIT_ENV
@@ -992,7 +1017,7 @@ async function resolveAll(deps, opts) {
       return;
     }
     const versions = Array.from(new Set(filtered.map((c) => c.version)));
-    const best = versions.sort((a, b) => semver.rcompare(coerceVersion(a), coerceVersion(b)))[0];
+    const best = versions.sort((a, b) => semver2.rcompare(coerceVersion(a), coerceVersion(b)))[0];
     const finalists = filtered.filter((c) => c.version === best);
     const canonicalRef = assetRefToStr({ ...ref, pin: best });
     const chosen = selectChosenCandidate(
@@ -1105,7 +1130,7 @@ async function crossCheckStoreDigest(chosen, finalists, canonicalRef, best, sour
   }
 }
 function coerceVersion(v) {
-  return semver.valid(v) ? v : semver.coerce(v)?.version ?? "0.0.0";
+  return semver2.valid(v) ? v : semver2.coerce(v)?.version ?? "0.0.0";
 }
 function matchPin(pin, version) {
   if (!pin) return true;
@@ -1115,17 +1140,17 @@ function matchPin(pin, version) {
   if (version.startsWith("0.0.0-sha.")) {
     return version === pin;
   }
-  if (!semver.valid(version)) return version === pin;
-  return semver.satisfies(version, pin, { includePrerelease: false });
+  if (!semver2.valid(version)) return version === pin;
+  return semver2.satisfies(version, pin, { includePrerelease: false });
 }
 function needsStoreVersionDiscovery(pin) {
   if (!pin) return true;
   if (SHA_PIN_RE.test(pin)) return false;
-  return !semver.valid(pin);
+  return !semver2.valid(pin);
 }
 function enumerateVersionsForPin(pin, sourceVersionsHint) {
   if (!pin) return sourceVersionsHint.length > 0 ? sourceVersionsHint : [];
-  if (semver.valid(pin)) return [pin];
+  if (semver2.valid(pin)) return [pin];
   return sourceVersionsHint;
 }
 function checkRepoStatus(decl, name, reposDir, projectDir) {
@@ -1192,6 +1217,27 @@ function checkRepoStatus(decl, name, reposDir, projectDir) {
 }
 
 // core/src/workspace-config.ts
+var SourceEntryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SourceEntryError";
+  }
+};
+function parseSourceEntries(raw) {
+  return raw.map((item, i) => {
+    const s = item && typeof item === "object" && !Array.isArray(item) ? item : void 0;
+    const url = s?.url;
+    if (typeof url !== "string" || url.trim() === "") {
+      throw new SourceEntryError(
+        `sources[${i}] has no url: ${JSON.stringify(item)} (write it as "- url: <git url>")`
+      );
+    }
+    const entry = { url };
+    const pin = s.pin;
+    if (typeof pin === "string" && pin.length > 0) entry.pin = pin;
+    return entry;
+  });
+}
 var DEFAULT_RECIPE_ATTR = "default";
 function validateAssetRecipeFlake(flake) {
   if (typeof flake !== "string" || flake.length === 0) {
@@ -1302,12 +1348,17 @@ function listSkWorkspaceConfigs(dir) {
   }
   return configs.sort((a, b) => a.name.localeCompare(b.name));
 }
+function rejectedKeyError(d) {
+  return d.code === "invalid_source_entry" ? new SourceEntryError(d.message) : new Error(d.message);
+}
 function resolveSkWorkspaceConfig(projectDir, opts) {
   const name = opts?.name ?? SK_WORKSPACE_DEFAULT_NAME;
   const configs = [];
   const assertNoLegacyKey = (file) => {
-    const d = file?.diagnostics?.find((x) => x.code === "legacy_key_rejected");
-    if (d) throw new Error(d.message);
+    const d = file?.diagnostics?.find(
+      (x) => x.code === "legacy_key_rejected" || x.code === "invalid_source_entry"
+    );
+    if (d) throw rejectedKeyError(d);
   };
   const userConfig = loadSkWorkspaceConfig(globalSkaileDir(), name);
   assertNoLegacyKey(userConfig);
@@ -1325,8 +1376,10 @@ function resolveSkWorkspaceConfig(projectDir, opts) {
 }
 function resolveGlobalSkWorkspaceConfig() {
   const file = loadSkWorkspaceConfig(globalSkaileDir(), SK_WORKSPACE_DEFAULT_NAME);
-  const legacy = file?.diagnostics?.find((x) => x.code === "legacy_key_rejected");
-  if (legacy) throw new Error(legacy.message);
+  const legacy = file?.diagnostics?.find(
+    (x) => x.code === "legacy_key_rejected" || x.code === "invalid_source_entry"
+  );
+  if (legacy) throw rejectedKeyError(legacy);
   return file?.config ?? {};
 }
 function resolveGlobalHarnesses() {
@@ -1758,16 +1811,7 @@ function normalizeDependencySection(raw, config) {
     if (valid.length > 0) config.global_harnesses = [...new Set(valid)];
   }
   if (Array.isArray(raw.sources)) {
-    const entries = [];
-    for (const item of raw.sources) {
-      if (!item || typeof item !== "object" || Array.isArray(item)) continue;
-      const s = item;
-      const url = typeof s.url === "string" ? s.url : "";
-      if (!url) continue;
-      const entry = { url };
-      if (typeof s.pin === "string" && s.pin.length > 0) entry.pin = s.pin;
-      entries.push(entry);
-    }
+    const entries = parseSourceEntries(raw.sources);
     if (entries.length > 0) config.sources = entries;
   }
   if (raw.telemetry && typeof raw.telemetry === "object" && !Array.isArray(raw.telemetry)) {
@@ -1826,7 +1870,9 @@ function decodeSkaileYaml(text) {
       config: {},
       diagnostics: [
         {
-          code: "legacy_key_rejected",
+          // A url-less `sources:` item is its own code so the runtime boundary can re-throw
+          // the typed error the CLI prints as one line.
+          code: err instanceof SourceEntryError ? "invalid_source_entry" : "legacy_key_rejected",
           severity: "error",
           message: err instanceof Error ? err.message : String(err)
         }
@@ -2591,6 +2637,6 @@ function resolveAgentDefinitionDir(projectDir, definition) {
   return resolve(projectDir, definition);
 }
 
-export { AGENT_INSTANCE_ID_PATTERN, AGENT_INSTANCE_LIFECYCLES, AGENT_INSTANCE_MEMORY_SCOPES, AGENT_INSTANCE_TRIGGER_KINDS, AgentRefResolutionError, COMPACTION_DEFAULTS, CanonicalRefConflictError, DEFAULT_AGENT_INSTANCE_ID, DEFAULT_RECIPE_ATTR, MAX_PRESET_DEPTH, PresetDepthError, SKAILE_YAML_DEFAULT, SKAILE_YAML_SUFFIX, SKILL_ALLOWLIST_FILE, SKILL_ALLOWLIST_VERSION, SK_WORKSPACE_DEFAULT_NAME, SK_WORKSPACE_SUFFIX, STAGED_SKILL_MARKER, UnknownAssetKindError, agentInstanceDiagnostics, agentSourceCacheDir, attachToBranch, buildProvenanceIndex, checkRepoStatus, checkoutPin, cloneRepo, coerceVersion, decodeSkaileYaml, deriveSingleMaterializedMcpDeclaration, effectiveAgentInstances, encodeSkaileYaml, ensureRepo, findWorkspaceRoot, getGlobalCacheDir, getRepoCommit, isStagedSkillMarkerFor, isWorkspaceConfigFilename, legacySourceCacheKey, linkRepo, listSkWorkspaceConfigs, loadMcpServerDeclarations, loadSkWorkspaceConfig, matchPin, mergeAgentInstances, mergeAgentPermissions, mergeSkWorkspaceConfigs, normalizeAgentInstances, normalizeConfig, pullRepo, pullRepoResult, readLinks, readSkillAllowList, resolveAgentDefinitionDir, resolveAgentDir, resolveAll, resolveAsset, resolveCompactionThresholdPercent, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, resolveSkWorkspaceConfig, resolveSourcePublisher, saveSkWorkspaceConfig, scanRepo, sourceCacheKey, sourceShortName, stageMaterializedSkills, stagedSkillMarkerState, storeManifestSlug, unlinkRepo, unstageSkill, validateAssetRecipeAttr, validateAssetRecipeFlake, workspaceConfigFilename, workspaceNameFromFilename, writeLinks };
-//# sourceMappingURL=chunk-JAKOMFC6.js.map
-//# sourceMappingURL=chunk-JAKOMFC6.js.map
+export { AGENT_INSTANCE_ID_PATTERN, AGENT_INSTANCE_LIFECYCLES, AGENT_INSTANCE_MEMORY_SCOPES, AGENT_INSTANCE_TRIGGER_KINDS, AgentRefResolutionError, COMPACTION_DEFAULTS, CanonicalRefConflictError, DEFAULT_AGENT_INSTANCE_ID, DEFAULT_RECIPE_ATTR, MAX_PRESET_DEPTH, PresetDepthError, SKAILE_YAML_DEFAULT, SKAILE_YAML_SUFFIX, SKILL_ALLOWLIST_FILE, SKILL_ALLOWLIST_VERSION, SK_WORKSPACE_DEFAULT_NAME, SK_WORKSPACE_SUFFIX, STAGED_SKILL_MARKER, SourceEntryError, UnknownAssetKindError, agentInstanceDiagnostics, agentSourceCacheDir, attachToBranch, buildProvenanceIndex, checkRepoStatus, checkoutPin, cloneRepo, coerceVersion, decodeSkaileYaml, deriveSingleMaterializedMcpDeclaration, effectiveAgentInstances, encodeSkaileYaml, ensureRepo, findWorkspaceRoot, getGlobalCacheDir, getRepoCommit, isStagedSkillMarkerFor, isWorkspaceConfigFilename, legacySourceCacheKey, linkRepo, listSkWorkspaceConfigs, loadMcpServerDeclarations, loadSkWorkspaceConfig, matchPin, mergeAgentInstances, mergeAgentPermissions, mergeSkWorkspaceConfigs, normalizeAgentInstances, normalizeConfig, parseSourceEntries, pullRepo, pullRepoResult, readLinks, readSkillAllowList, resolveAgentDefinitionDir, resolveAgentDir, resolveAll, resolveAsset, resolveCompactionThresholdPercent, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, resolveSkWorkspaceConfig, resolveSourcePublisher, saveSkWorkspaceConfig, scanRepo, sourceCacheKey, sourceShortName, stageMaterializedSkills, stagedSkillMarkerState, storeManifestSlug, unlinkRepo, unstageSkill, validateAssetRecipeAttr, validateAssetRecipeFlake, workspaceConfigFilename, workspaceNameFromFilename, writeLinks };
+//# sourceMappingURL=chunk-JZCSNEHK.js.map
+//# sourceMappingURL=chunk-JZCSNEHK.js.map