@vltpkg/cli-js 1.3.8 → 1.5.0

package/security-archive-src-update-expired.js

@@ -251,7 +251,27 @@ import {
 import { inspect } from "node:util";
 
 // ../../src/fast-split/src/index.ts
+var splitTwo = (str, delim) => {
+  const a = str.indexOf(delim);
+  return a === -1 ? [str] : [str.substring(0, a), str.substring(a + delim.length)];
+};
+var splitThree = (str, delim) => {
+  const a = str.indexOf(delim);
+  if (a === -1) return [str];
+  const l = delim.length;
+  const b = str.indexOf(delim, a + l);
+  return b === -1 ? [str.substring(0, a), str.substring(a + l)] : [
+    str.substring(0, a),
+    str.substring(a + l, b),
+    str.substring(b + l)
+  ];
+};
 function fastSplit(str, delim, limit = -1, onPart) {
+  if (onPart === void 0) {
+    if (limit === 2) return splitTwo(str, delim);
+    if (limit === 3)
+      return splitThree(str, delim);
+  }
   let i = 0;
   let p = 0;
   const l = delim.length;
@@ -1292,9 +1312,10 @@ var gitHostWebsites = {
   gitlab: "https://gitlab.com/"
 };
 var getOptions = (options) => ({
-  catalog: {},
   catalogs: {},
   ...options,
+  // after spread: explicit `catalog: undefined` gets default too
+  catalog: options?.catalog ?? {},
   // built-in aliases are user/service-overridable: user config wins
   "jsr-registries": {
     ...defaultJsrRegistries,
@@ -1471,19 +1492,25 @@ var Spec = class _Spec {
     }
     if (this.bareSpec.startsWith("catalog:")) {
       this.catalog = this.bareSpec.substring("catalog:".length);
-      const catalog = this.catalog ? this.options.catalogs?.[this.catalog] : this.options.catalog;
+      const { catalog: defaultCatalog, catalogs = {} } = this.options;
+      const catalog = this.catalog ? Object.hasOwn(catalogs, this.catalog) ? catalogs[this.catalog] : void 0 : Object.keys(defaultCatalog).length ? defaultCatalog : void 0;
       if (!catalog) {
-        throw this.#error("Named catalog not found", {
-          name: this.catalog,
-          validOptions: this.options.catalogs && Object.keys(this.options.catalogs)
-        });
+        throw this.#catalogError(
+          this.catalog ? `Catalog "${this.catalog}" not found for ${this.spec}` : `Default catalog not found for ${this.spec}`
+        );
       }
-      const sub = catalog[this.name];
+      const catalogName = this.catalog ? `catalog "${this.catalog}"` : "default catalog";
+      const sub = Object.hasOwn(catalog, this.name) ? catalog[this.name] : void 0;
       if (!sub) {
-        throw this.#error("Name not found in catalog", {
-          name: this.name,
-          validOptions: Object.keys(catalog)
-        });
+        throw this.#catalogError(
+          `Package "${this.name}" not found in ${catalogName}`
+        );
+      }
+      if (sub.startsWith("catalog:")) {
+        throw this.#error(
+          `Catalog entry "${this.name}" in ${catalogName} cannot be a catalog: spec`,
+          { code: "ECONFIG", found: sub }
+        );
       }
       this.subspec = _Spec.parse(this.name, sub, this.options);
       this.type = "catalog";
@@ -1799,6 +1826,23 @@ var Spec = class _Spec {
       ].map((p) => `${p}:`)
     });
   }
+  /** ECONFIG error listing defined catalogs & ones defining this dep */
+  #catalogError(message) {
+    const { catalog, catalogs = {} } = this.options;
+    const defined = [
+      ...Object.keys(catalog).length ? [["", catalog]] : [],
+      ...Object.entries(catalogs)
+    ];
+    const validOptions = defined.map(([n]) => `catalog:${n}`);
+    const wanted = defined.filter(
+      ([, c]) => Object.hasOwn(c, this.name) && !!c[this.name]
+    ).map(([n]) => `catalog:${n}`);
+    return this.#error(message, {
+      code: "ECONFIG",
+      ...validOptions.length ? { validOptions } : {},
+      ...wanted.length ? { wanted } : {}
+    });
+  }
   #error(message, extra = {}) {
     return error(message, { spec: this.spec, ...extra }, this.#error);
   }
@@ -2146,7 +2190,7 @@ var baseDepID = (id) => {
 var package_default = {
   name: "@vltpkg/user-agent",
   description: "The User-Agent string that vlt sends with every outbound request",
-  version: "1.3.8",
+  version: "1.5.0",
   repository: {
     type: "git",
     url: "git+https://github.com/vltpkg/vltpkg.git",
@@ -2223,13 +2267,35 @@ var asPackageReportData = (o) => {
   }
   return o;
 };
+var getItemScore = (data) => {
+  if (data._type || !data.score) return void 0;
+  const {
+    license,
+    maintenance,
+    quality,
+    supplyChain,
+    vulnerability
+  } = data.score;
+  const scoreComponents = [
+    license,
+    maintenance,
+    quality,
+    supplyChain,
+    vulnerability
+  ];
+  const overall = Number(
+    (scoreComponents.reduce((sum, score) => sum + score, 0) / scoreComponents.length).toFixed(2)
+  );
+  return { ...data.score, overall };
+};
 
 // ../../src/security-archive/src/update-expired.ts
 var __CODE_SPLIT_SCRIPT_NAME = import.meta.filename;
 var SOCKET_API_V0_URL = "https://api.socket.dev/v0/purl?alerts=true";
 var SOCKET_PUBLIC_API_TOKEN = "sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api";
 var isMain = (path) => path === __CODE_SPLIT_SCRIPT_NAME || path === pathToFileURL(__CODE_SPLIT_SCRIPT_NAME).toString();
-var retrieveRemoteData = async (queue, retries) => {
+var retrieveRemoteData = async (queue, retries, timeout) => {
+  const signal = AbortSignal.timeout(timeout);
   return pRetry(
     async () => {
       const req = await fetch(SOCKET_API_V0_URL, {
@@ -2240,7 +2306,8 @@ var retrieveRemoteData = async (queue, retries) => {
         },
         body: JSON.stringify({
           components: Array.from(queue)
-        })
+        }),
+        signal
       });
       if (req.status === 404) {
         throw new AbortError("Missing API");
@@ -2253,7 +2320,7 @@ var retrieveRemoteData = async (queue, retries) => {
       const str = await req.text();
       return str.trim() + "\n";
     },
-    { retries }
+    { retries, signal }
   );
 };
 var main = async (input = process.stdin) => {
@@ -2276,7 +2343,7 @@ var main = async (input = process.stdin) => {
       input.on("error", reject);
     }
   );
-  const { dbPath, retries, ttl, expired } = payload;
+  const { dbPath, retries, timeout, ttl, expired } = payload;
   if (!expired.length) {
     return false;
   }
@@ -2287,13 +2354,14 @@ var main = async (input = process.stdin) => {
     expiredQueue.add({ purl });
     entryByNameVersion.set(`${entry.name}@${entry.version}`, entry);
   }
-  const res = await retrieveRemoteData(expiredQueue, retries);
+  const res = await retrieveRemoteData(expiredQueue, retries, timeout);
   const now = Date.now();
   const results = [];
   const json = res.split("}\n");
   for (const line of json) {
     if (!line.trim()) continue;
     const data = JSON.parse(line + "}");
+    if (data._type) continue;
     const scope = data.namespace ? `${data.namespace}/` : "";
     const name = `${scope}${data.name}`;
     const key = `${name}@${data.version}`;
@@ -2304,19 +2372,11 @@ var main = async (input = process.stdin) => {
       );
       continue;
     }
-    const scoreComponents = [
-      data.score.license,
-      data.score.maintenance,
-      data.score.quality,
-      data.score.supplyChain,
-      data.score.vulnerability
-    ];
-    const newAverageScore = Number(
-      (scoreComponents.reduce((sum, score) => sum + score, 0) / scoreComponents.length).toFixed(2)
-    );
+    const score = getItemScore(data);
+    if (!score) continue;
     const reportData = asPackageReportData({
       ...data,
-      score: { ...data.score, overall: newAverageScore }
+      score
     });
     results.push({
       depID: baseDepID(asDepID(entry.depID)),

package/{setup-PLEKCMXN.js → setup-XPAM5U3Z.js}

@@ -11,39 +11,41 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   stdout
-} from "./chunk-XDSZO74H.js";
-import "./chunk-KMOOTBHM.js";
-import "./chunk-G2YT2GWF.js";
-import "./chunk-IHXJVKAE.js";
+} from "./chunk-WHWPAYZY.js";
+import "./chunk-X6JKMIOU.js";
+import "./chunk-4TSHLSRK.js";
+import {
+  commandUsage
+} from "./chunk-CW56EJIL.js";
 import {
   configWriteTarget,
   registrySelectionFields
-} from "./chunk-43HNQWPQ.js";
-import "./chunk-DL3H4EMY.js";
+} from "./chunk-XCQCYB6G.js";
+import "./chunk-VR7NRWAD.js";
 import "./chunk-SRWDPPLX.js";
+import "./chunk-IFEZ6BFV.js";
+import "./chunk-C6ZVVEFV.js";
+import "./chunk-4KCU2KZL.js";
 import "./chunk-WGDTG44V.js";
 import {
   normalizeRegistryURL
-} from "./chunk-A2TSRXZD.js";
-import {
-  commandUsage
-} from "./chunk-TLY4VGMH.js";
-import "./chunk-CB65DPZ2.js";
-import "./chunk-4KCU2KZL.js";
-import "./chunk-SV4WK3KX.js";
-import "./chunk-GZ5MYMBT.js";
-import "./chunk-SE2FSMBR.js";
+} from "./chunk-UZ6ICZE3.js";
+import "./chunk-CMLDLZZ3.js";
+import "./chunk-F7NPYSI2.js";
+import "./chunk-LUVDMEW4.js";
 import "./chunk-HTOTG4TS.js";
 import {
   RegistryClient,
   getKC,
   normalizeRegistryKey
-} from "./chunk-5KOLUYXH.js";
-import "./chunk-APMYKJI2.js";
-import "./chunk-6D54UN4T.js";
-import "./chunk-6BQKR2FM.js";
-import "./chunk-U7TEQCBN.js";
+} from "./chunk-35EG6T3J.js";
+import "./chunk-QNHBAGXQ.js";
+import "./chunk-G3FZ2ZJK.js";
+import "./chunk-5KW6AOTT.js";
+import "./chunk-SUU2WETN.js";
+import "./chunk-B6RIGNEO.js";
 import "./chunk-XNLSTHDK.js";
+import "./chunk-6IF3RJND.js";
 import "./chunk-PDWPFR5T.js";
 import "./chunk-Y5PA7DVK.js";
 import {
@@ -51,7 +53,7 @@ import {
   defaultRegistries,
   isErrorWithCause,
   isObject
-} from "./chunk-IBGFQR23.js";
+} from "./chunk-6LZM3I4Q.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/skills-LR6GXW3X.js

@@ -0,0 +1,413 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  mermaidOutput
+} from "./chunk-4UH3KMTD.js";
+import {
+  assertQuery,
+  linkSkills,
+  listSkills
+} from "./chunk-2U4PVHP4.js";
+import "./chunk-SMXXFQPI.js";
+import {
+  styleTextStdout
+} from "./chunk-WHWPAYZY.js";
+import "./chunk-X6JKMIOU.js";
+import "./chunk-4TSHLSRK.js";
+import {
+  commandUsage
+} from "./chunk-CW56EJIL.js";
+import {
+  configLabel,
+  savedLine,
+  storedAllowSkills,
+  unmatchedLines,
+  unscannedLines
+} from "./chunk-W4T5CGCO.js";
+import {
+  configWriteTarget
+} from "./chunk-XCQCYB6G.js";
+import "./chunk-VR7NRWAD.js";
+import "./chunk-SRWDPPLX.js";
+import "./chunk-IFEZ6BFV.js";
+import "./chunk-C6ZVVEFV.js";
+import "./chunk-4KCU2KZL.js";
+import "./chunk-WGDTG44V.js";
+import "./chunk-UZ6ICZE3.js";
+import "./chunk-CMLDLZZ3.js";
+import "./chunk-F7NPYSI2.js";
+import "./chunk-LUVDMEW4.js";
+import "./chunk-HTOTG4TS.js";
+import "./chunk-G3FZ2ZJK.js";
+import "./chunk-5KW6AOTT.js";
+import "./chunk-SUU2WETN.js";
+import "./chunk-B6RIGNEO.js";
+import "./chunk-XNLSTHDK.js";
+import "./chunk-6IF3RJND.js";
+import "./chunk-PDWPFR5T.js";
+import "./chunk-Y5PA7DVK.js";
+import {
+  asError
+} from "./chunk-6LZM3I4Q.js";
+import {
+  error
+} from "./chunk-WZWDS3W4.js";
+import "./chunk-PZLD7RTK.js";
+
+// ../../src/cli-sdk/src/commands/skills.ts
+import { styleText } from "node:util";
+
+// ../../src/cli-sdk/src/skills-prompt.ts
+import { createInterface } from "node:readline/promises";
+var interactive = () => process.stdin.isTTY;
+var open = (s) => {
+  const rl = createInterface({
+    input: s.input ?? process.stdin,
+    output: s.output ?? process.stdout,
+    // prefill and line editing
+    terminal: true
+  });
+  rl.on("SIGINT", () => rl.close());
+  let done = false;
+  const closed = new Promise(
+    (r) => rl.once("close", () => {
+      done = true;
+      r(void 0);
+    })
+  );
+  const ask = async (query, prefill) => {
+    if (done) return void 0;
+    const q = rl.question(query).catch(() => void 0);
+    if (prefill) rl.write(prefill);
+    return Promise.race([q, closed]);
+  };
+  return { rl, ask };
+};
+var confirm = async (question, s = {}) => {
+  const { rl, ask } = open(s);
+  try {
+    const a = await ask(question);
+    return a === void 0 ? void 0 : /^y(es)?$/i.test(a.trim());
+  } finally {
+    rl.close();
+  }
+};
+var editQuery = async ({
+  current,
+  prefill,
+  check,
+  ...s
+}) => {
+  const output = s.output ?? process.stdout;
+  if (current !== void 0) {
+    output.write(
+      "\n\u26A0\uFE0F The new allow-skills replaces the current one. Make sure it still\nselects every skill you want: skills it no longer selects are unlinked.\n\n" + styleTextStdout(
+        "yellow",
+        `Current allow-skills: ${current}`
+      ) + "\n"
+    );
+  }
+  const prompt = styleTextStdout("cyan", "New allow-skills: ");
+  const { rl, ask } = open(s);
+  try {
+    let fill = prefill;
+    for (; ; ) {
+      const a = (await ask(prompt, fill))?.trim();
+      if (!a) return void 0;
+      try {
+        await check(a);
+        return a;
+      } catch (e) {
+        output.write(`${asError(e).message}
+`);
+        fill = a;
+      }
+    }
+  } finally {
+    rl.close();
+  }
+};
+
+// ../../src/cli-sdk/src/commands/skills.ts
+var needsRegistry = true;
+var usage = () => commandUsage({
+  command: "skills",
+  usage: ["", "list [<query>]", "link [<query>]"],
+  description: `Manage the agent skills shipped by installed packages.
+
+      A skill is a folder with a \`SKILL.md\` file
+      (https://agentskills.io/specification). Packages ship them as a
+      root \`SKILL.md\`, or at \`<name>/SKILL.md\` in \`skills/\`,
+      \`dist/skills/\` or \`.agents/skills/\`: the first skill of a name
+      wins.
+
+      Skills are linked into the project's agent skill dirs:
+      \`.agents/skills\`, plus \`<folder>/skills\` for each agent folder
+      at the project root (e.g. \`.claude/\`), or the \`skills-dir\`
+      config. When packages ship skills with the same name, one is
+      linked and the others are reported. Only links made by vlt
+      (pointing into \`node_modules/.vlt\`) are ever replaced or
+      removed; anything else in the way is skipped.
+
+      Use --target or a query after the subcommand to select packages
+      using DSS query syntax. End a selector with
+      \`:skill(<name>, \u2026)\` to pick single skills, e.g.
+      \`#skills:skill(find-skills)\`. Use
+      \`vlt install --allow-skills=<query>\` to link skills on install.`,
+  subcommands: {
+    list: {
+      usage: "[<query>]",
+      description: `List the skills of installed packages. The default.
+                      Selects all packages (\`*\`) by default. Applies
+                      \`:skill()\`: preview a query before \`link\` saves
+                      it.`
+    },
+    link: {
+      usage: "[<query>]",
+      description: `Set, save and apply \`allow-skills\`: link what the
+                      query selects and remove vlt links to other skills.
+                      With no query: the stored one, or
+                      \`:not(:malware)\`. Asks before replacing or editing
+                      a stored query (-y skips). Saves to the project
+                      vlt.json, or the user one with --config=user.`
+    }
+  },
+  options: {
+    target: {
+      value: "<query>",
+      description: "Query selector to filter packages using DSS syntax."
+    },
+    yes: {
+      description: "Skip the prompts: replace or keep the stored allow-skills without asking."
+    },
+    config: {
+      value: "user|project",
+      description: "vlt.json to save allow-skills to (default: project)."
+    },
+    view: {
+      value: "[human | json | mermaid]",
+      description: "Output format. mermaid: list only."
+    }
+  }
+});
+var plural = (n, s) => `${n} ${s}${n === 1 ? "" : "s"}`;
+var lines = (header, items) => [header, ...items.map((i) => `  ${i}`)].join("\n");
+var notes = (r) => [
+  ...r.skipped ? [`\u26A0\uFE0F Skipped ${r.skipped.join(", ")}`] : [],
+  ...r.gitignore ? [`\u26A0\uFE0F Could not update ${r.gitignore.join(", ")}`] : [],
+  ...unscannedLines(r)
+];
+var pkgLabel = (s) => {
+  const pkg = s.version ? `${s.name}@${s.version}` : s.name;
+  return s.alias ? `${s.alias} (${pkg})` : pkg;
+};
+var linkedSuffix = (s, dirs) => dirs.length && dirs.every((d) => s.linked.includes(d)) ? " (linked)" : s.linked.length ? ` (linked in ${s.linked.join(", ")})` : "";
+var row = (s, dirs) => `${s.skill} (${pkgLabel(s)})${linkedSuffix(s, dirs)}`;
+var listNotes = (r) => [
+  ...!r.dirs.length && !r.skipped ? ["No agent skill dirs: skills-dir is empty"] : [],
+  ...notes(r)
+];
+var humanList = (r, { colors } = {}) => {
+  const style = (format) => (s) => colors ? styleText(format, s, { validateStream: false }) : s;
+  const yellow = style("yellow");
+  const rows = r.skills.map((s) => {
+    const x = row(s, r.dirs);
+    return s.linked.length ? yellow(x) : x;
+  });
+  const last = rows.length - 1;
+  return [
+    ...rows.length ? [
+      style("reset")(
+        [
+          r.project,
+          ...rows.map(
+            (x, i) => `${i === last ? "\u2514\u2500\u2500" : "\u251C\u2500\u2500"} ${x}`
+          )
+        ].join("\n")
+      )
+    ] : ["No agent skills found in installed packages."],
+    ...listNotes(r)
+  ].join("\n");
+};
+var mermaidList = (r) => {
+  const children = /* @__PURE__ */ new Map();
+  for (const s of r.skills) {
+    const list = children.get(s.id) ?? [];
+    list.push({
+      edge: pkgLabel(s),
+      label: `${s.skill}${linkedSuffix(s, r.dirs)}`
+    });
+    children.set(s.id, list);
+  }
+  const { graph } = r;
+  return [
+    mermaidOutput({
+      edges: [],
+      importers: /* @__PURE__ */ new Set([graph.mainImporter]),
+      nodes: [...graph.nodes.values()].filter(
+        (n) => n === graph.mainImporter || children.has(n.id)
+      ),
+      children
+    }),
+    ...listNotes(r).map((n) => `%% ${n}`)
+  ].join("\n");
+};
+var jsonSkill = ({
+  skill,
+  name,
+  alias,
+  version,
+  id,
+  description,
+  ...rest
+}) => ({
+  name: skill,
+  description,
+  "dependency-name": alias ?? name,
+  "package-id": id,
+  ...rest
+});
+var count = (rows) => new Set(rows.map((r) => `${r.id}\0${r.skill}`)).size;
+var humanLink = (r) => {
+  const out = [];
+  if (r.linked.length) {
+    out.push(
+      lines(
+        `\u{1F517} Linked ${plural(count(r.linked), "agent skill")}:`,
+        r.linked.map((s) => s.mount)
+      )
+    );
+  } else if (r.unchanged.length) {
+    out.push(
+      `${plural(count(r.unchanged), "agent skill")} already linked.`
+    );
+  }
+  if (r.removed.length) {
+    out.push(
+      lines(
+        `\u{1F9F9} Removed ${plural(r.removed.length, "skill link")}:`,
+        r.removed
+      )
+    );
+  }
+  if (r.conflicts.length) {
+    out.push(
+      lines(
+        `\u26A0\uFE0F Skipped ${plural(r.conflicts.length, "skill")}, path in use or taken by another package:`,
+        r.conflicts
+      )
+    );
+  }
+  out.push(...notes(r));
+  return out.join("\n") || "No agent skills found to link.";
+};
+var human = (r, o) => r.action === "list" ? humanList(r, o) : r.action === "unchanged" ? "No changes made." : [
+  humanLink(r),
+  ...unmatchedLines(r.unmatched),
+  ...r.saved ? [savedLine(r.query, r.saved)] : []
+].join("\n");
+var views = {
+  human,
+  json: (r) => {
+    if (r.action !== "list") return r;
+    const { project, graph, ...rest } = r;
+    return { ...rest, skills: rest.skills.map(jsonSkill) };
+  },
+  mermaid: (r) => r.action === "list" ? mermaidList(r) : human(r)
+};
+var defaultQuery = ":not(:malware)";
+var where = (which) => which === "user" ? "in the user vlt.json" : "for this project (vlt.json)";
+var pickQuery = async (conf, given) => {
+  const check = (q) => assertQuery(q, "allow-skills", ["skill"]);
+  const stored = storedAllowSkills(conf);
+  const yes = !!conf.get("yes");
+  const tty = interactive();
+  if (given) {
+    await check(given);
+    if (!stored || stored.query === given || yes) return given;
+    if (!tty) {
+      throw error(
+        `allow-skills is already set (${configLabel(stored.which)}): "${stored.query}"; pass -y to replace it`,
+        { code: "EUSAGE", found: given, wanted: stored.query }
+      );
+    }
+    if (!await confirm(
+      `allow-skills is already set ${where(stored.which)}: "${stored.query}". Replace it? [y/N] `
+    )) {
+      return void 0;
+    }
+    return editQuery({ current: stored.query, prefill: given, check });
+  }
+  if (stored) {
+    if (yes || !tty) return stored.query;
+    const edit = await confirm(
+      `allow-skills is set ${where(stored.which)}: "${stored.query}". Edit it? [y/N] `
+    );
+    if (edit === void 0) return void 0;
+    return edit ? editQuery({
+      current: stored.query,
+      prefill: stored.query,
+      check
+    }) : stored.query;
+  }
+  if (yes || !tty) return defaultQuery;
+  return editQuery({ prefill: defaultQuery, check });
+};
+var command = async (conf) => {
+  const [sub = "list", query] = conf.positionals;
+  const target = conf.get("target") || query;
+  const opts = {
+    ...conf.options,
+    projectRoot: conf.projectRoot,
+    skillsDirs: conf.get("skills-dir")
+  };
+  switch (sub) {
+    case "list":
+    case "ls":
+      return {
+        action: "list",
+        ...await listSkills({ ...opts, target })
+      };
+    case "link": {
+      const query2 = await pickQuery(conf, target);
+      if (query2 === void 0) return { action: "unchanged" };
+      const res = await linkSkills({
+        ...opts,
+        target: query2,
+        apply: true
+      });
+      let saved;
+      if (storedAllowSkills(conf)?.query !== query2) {
+        saved = configWriteTarget(conf, "project");
+        await conf.addConfigToFile(saved, { "allow-skills": query2 });
+      }
+      return {
+        action: "link",
+        query: query2,
+        ...saved && { saved },
+        ...res
+      };
+    }
+    default:
+      throw error("Unknown skills subcommand", {
+        code: "EUSAGE",
+        found: sub,
+        validOptions: ["list", "ls", "link"]
+      });
+  }
+};
+export {
+  command,
+  needsRegistry,
+  usage,
+  views
+};