DF0065: Invalid Remote Assets Package Or Version

Message

Invalid remote-assets {field} "{value}".

Cause

A remote-assets source's package and version are interpolated into CDN URLs (https://cdn.jsdelivr.net/npm/<package>@<version>/…) and into the on-disk cache path (.remote-assets/<package>@<version>/). To keep those safe and well-formed, the package must be a valid npm package name and the version an exact semver version — a value carrying path separators, @, whitespace, or traversal segments (..) is rejected.

Example

defineDevframe({
  cli: {
    distDir: {
      package: '@devframes/plugin-git-client',
      version: '../etc', // ✗ not a semver version
    },
  },
})

Fix

Use a valid npm package name and an exact version:

defineDevframe({
  cli: {
    distDir: {
      package: '@devframes/plugin-git-client',
      version: '1.2.3',
    },
  },
})

Source

• packages/devframe/src/utils/remote-assets.ts — resolveStaticAssetsSource() validates a remote source before resolving it.