@vltpkg/cli-sdk 1.3.8 → 1.5.0

package/dist/allow-skills.d.ts

@@ -0,0 +1,36 @@
+import type { UnmatchedPattern, UnscannedSkills } from '@vltpkg/graph';
+import type { WhichConfig } from '@vltpkg/vlt-json';
+import type { LoadedConfig } from './config/index.ts';
+/** An `allow-skills` query stored in a config file. */
+export type StoredAllowSkills = {
+    query: string;
+    which: WhichConfig;
+};
+/**
+ * Outcome of saving `--allow-skills` after install/update. `stored`
+ * set: another query is stored and was kept.
+ */
+export type AllowSkillsSave = {
+    query: string;
+    stored?: StoredAllowSkills;
+};
+/**
+ * The top-level `allow-skills` of the project vlt.json, else the user
+ * one. A project `null` or `''` drops the user's.
+ */
+export declare const storedAllowSkills: (conf: Pick<LoadedConfig, "layers">) => StoredAllowSkills | undefined;
+/** The file's name in messages. */
+export declare const configLabel: (which: WhichConfig) => string;
+/**
+ * After a successful install/update: save an explicit `--allow-skills`
+ * to the project vlt.json, unless another query is stored.
+ */
+export declare const saveAllowSkills: (conf: LoadedConfig) => Promise<AllowSkillsSave | undefined>;
+/** Warnings for `:skill()` patterns that matched nothing. */
+export declare const unmatchedLines: (unmatched?: UnmatchedPattern[]) => string[];
+/** Skills left out: their packages have no security data. */
+export declare const unscannedLines: ({ unscanned, unscannedReason, }: UnscannedSkills) => string[];
+/** `allow-skills` saved to a config file. */
+export declare const savedLine: (query: string, which: WhichConfig) => string;
+/** `--allow-skills` not saved: another query is stored. */
+export declare const keptLine: (s: StoredAllowSkills) => string;

package/dist/allow-skills.js

@@ -0,0 +1,49 @@
+/**
+ * The top-level `allow-skills` of the project vlt.json, else the user
+ * one. A project `null` or `''` drops the user's.
+ */
+export const storedAllowSkills = (conf) => {
+    const { project, user } = conf.layers;
+    const p = project?.['allow-skills'];
+    if (p)
+        return { query: p, which: 'project' };
+    if (project && 'allow-skills' in project)
+        return undefined;
+    const u = user?.['allow-skills'];
+    return u ? { query: u, which: 'user' } : undefined;
+};
+/** The file's name in messages. */
+export const configLabel = (which) => which === 'user' ? 'user vlt.json' : 'vlt.json';
+/**
+ * After a successful install/update: save an explicit `--allow-skills`
+ * to the project vlt.json, unless another query is stored.
+ */
+export const saveAllowSkills = async (conf) => {
+    const query = conf.explicit['allow-skills'];
+    if (!query || query === ':not(*)')
+        return undefined;
+    const stored = storedAllowSkills(conf);
+    if (stored?.query === query)
+        return undefined;
+    if (stored)
+        return { query, stored };
+    await conf.addConfigToFile('project', { 'allow-skills': query });
+    return { query };
+};
+/** Warnings for `:skill()` patterns that matched nothing. */
+export const unmatchedLines = (unmatched = []) => unmatched.map(({ pattern, skills }) => `⚠️ No skill matches "${pattern}"; ${!skills ? 'no installed package matches its selector'
+    : skills.length ?
+        `the selected packages ship: ${skills.join(', ')}`
+        : 'the selected packages ship no skills'}`);
+/** Skills left out: their packages have no security data. */
+export const unscannedLines = ({ unscanned = [], unscannedReason, }) => unscanned.length ?
+    [
+        `⏳ ${unscanned.length} skill${unscanned.length === 1 ? '' : 's'} left out, ${unscannedReason === 'timeout' ?
+            'security data timed out'
+            : 'Socket has not scanned their packages yet'}: ${unscanned.join(', ')}. Try again later.`,
+    ]
+    : [];
+/** `allow-skills` saved to a config file. */
+export const savedLine = (query, which) => `Saved allow-skills="${query}" to ${configLabel(which)}`;
+/** `--allow-skills` not saved: another query is stored. */
+export const keptLine = (s) => `allow-skills is already set (${configLabel(s.which)}): "${s.query}"; not replaced. Run vlt skills link to change it, or edit ${configLabel(s.which)}`;

package/dist/commands/build.d.ts

@@ -3,6 +3,13 @@ import type { CommandFn, CommandUsage } from '../index.ts';
 export declare const views: {
     readonly human: (result: BuildResult) => string;
     readonly json: (result: BuildResult) => {
+        message: string;
+        skipped?: {
+            id: import("@vltpkg/dep-id").DepID;
+            name: string;
+            version: string | undefined;
+        }[] | undefined;
+        skippedReason?: "timeout" | "unscanned" | undefined;
         success: {
             id: import("@vltpkg/dep-id").DepID;
             name: string;
@@ -13,7 +20,6 @@ export declare const views: {
             name: string;
             version: string | undefined;
         }[];
-        message: string;
     };
 };
 export declare const needsRegistry = true;

package/dist/commands/build.js

@@ -2,39 +2,49 @@ import { build } from '@vltpkg/graph';
 import { error } from '@vltpkg/error-cause';
 import { commandUsage } from "../config/usage.js";
 import { isErrorWithCause } from '@vltpkg/types';
+const skippedMessage = (count, reason) => `${count} package${count === 1 ? '' : 's'} not built, ${reason === 'unscanned' ?
+    'Socket has not scanned them yet'
+    : 'security data timed out'}. Run "vlt build" again later.`;
 export const views = {
     human: (result) => {
         const successCount = result.success.length;
         const failureCount = result.failure.length;
+        const skippedCount = result.skipped?.length ?? 0;
         const messages = [];
         if (successCount > 0) {
             messages.push(`🔨 Built ${successCount} package${successCount === 1 ? '' : 's'} successfully.`);
         }
-        else {
+        else if (!skippedCount) {
             messages.push('📦 All packages are already built.');
         }
         if (failureCount > 0) {
             messages.push(`🔎 ${failureCount} optional package${ /* c8 ignore next */failureCount === 1 ? '' : 's'} failed to build.`);
         }
+        if (skippedCount > 0) {
+            messages.push(`⏳ ${skippedMessage(skippedCount, result.skippedReason)}`);
+        }
         return messages.join('\n');
     },
     json: (result) => {
-        const successList = result.success.map(node => ({
+        const toJSON = (node) => ({
             id: node.id,
             name: node.name,
             version: node.version,
-        }));
-        const failureList = result.failure.map(node => ({
-            id: node.id,
-            name: node.name,
-            version: node.version,
-        }));
+        });
+        const successList = result.success.map(toJSON);
+        const failureList = result.failure.map(toJSON);
+        const skippedList = result.skipped?.map(toJSON) ?? [];
         return {
             success: successList,
             failure: failureList,
+            ...(skippedList.length ?
+                { skipped: skippedList, skippedReason: result.skippedReason }
+                : {}),
             message: successList.length > 0 ?
                 `Built ${successList.length} package${successList.length === 1 ? '' : 's'}.`
-                : 'No packages needed building.',
+                : skippedList.length ?
+                    skippedMessage(skippedList.length, result.skippedReason)
+                    : 'No packages needed building.',
         };
     },
 };

package/dist/commands/cache.d.ts

@@ -56,8 +56,8 @@ declare const usageDef: {
             readonly description: "Check global store entries against their cached\n                    tarballs (file list, contents, exec bits) and remove\n                    any that differ or have no cached tarball, e.g. after\n                    a file in `node_modules` was edited in place.";
         };
         readonly 'prune-store': {
-            readonly usage: "";
-            readonly description: "Remove global store entries that no `node_modules`\n                    folder links to. Entries ever copied from (install\n                    scripts, `store-linker=copy`, a cache on another\n                    drive) stay: copies do not show use.";
+            readonly usage: "[<date>]";
+            readonly description: "Remove global store entries that no `node_modules`\n                    folder links to. Copies do not show use: an entry\n                    copied or cloned from (install scripts,\n                    `store-linker=copy`, macOS, a cache on another\n                    drive) stays if that last happened after\n                    `<date>`, or in the last 30 days\n                    without one.";
         };
     };
     readonly examples: {

package/dist/commands/cache.js

@@ -1,7 +1,7 @@
 import { error } from '@vltpkg/error-cause';
 import { CacheEntry, assertOk } from '@vltpkg/registry-client';
 import { Spec } from '@vltpkg/spec';
-import { removeStoreEntry, storeEntryCopied, storeEntryLinked, storeEntryNames, storeEntryTime, verifyStoreEntry, } from '@vltpkg/tar/store-entry';
+import { removeStoreEntry, storeEntryCopied, storeEntryLastCopied, storeEntryLinked, storeEntryNames, storeEntryTime, verifyStoreEntry, } from '@vltpkg/tar/store-entry';
 import { readStoreIndex } from '@vltpkg/tar/store-index';
 import { integrityHex } from '@vltpkg/types';
 import { readFileSync } from 'node:fs';
@@ -24,6 +24,8 @@ export class CacheView extends ViewClass {
 export const views = {
     human: CacheView,
 };
+/** `prune-store`: days a copied entry stays, by default */
+const pruneDays = 30;
 const usageDef = {
     command: 'cache',
     usage: '<command> [flags]',
@@ -76,11 +78,14 @@ const usageDef = {
                     a file in \`node_modules\` was edited in place.`,
         },
         'prune-store': {
-            usage: '',
+            usage: '[<date>]',
             description: `Remove global store entries that no \`node_modules\`
-                    folder links to. Entries ever copied from (install
-                    scripts, \`store-linker=copy\`, a cache on another
-                    drive) stay: copies do not show use.`,
+                    folder links to. Copies do not show use: an entry
+                    copied or cloned from (install scripts,
+                    \`store-linker=copy\`, macOS, a cache on another
+                    drive) stays if that last happened after
+                    \`<date>\`, or in the last ${pruneDays} days
+                    without one.`,
         },
     },
     examples: {
@@ -335,14 +340,24 @@ const verify = async (conf, specs, view) => {
         ...(!all && { missing }),
     };
 };
-const pruneStore = async (conf, _, view) => {
+const pruneStore = async (conf, args, view) => {
+    const since = args.length ?
+        new Date(args.join(' ')).getTime()
+        : Date.now() - pruneDays * 24 * 60 * 60 * 1000;
+    if (Number.isNaN(since)) {
+        throw error('Invalid date', {
+            code: 'EUSAGE',
+            found: args.join(' '),
+        });
+    }
     const { storeRoot } = conf.options;
     const names = storeEntryNames(storeRoot);
     const removed = {};
     for (const hex of names) {
         const entry = resolve(storeRoot, hex);
         const index = readStoreIndex(entry);
-        if (storeEntryCopied(entry, index) ||
+        if ((storeEntryCopied(entry, index) &&
+            storeEntryLastCopied(entry) >= since) ||
             storeEntryLinked(entry, index)) {
             continue;
         }

package/dist/commands/ci.d.ts

@@ -1,6 +1,6 @@
 import type { CommandFn, CommandUsage } from '../index.ts';
 import type { InstallResult } from './install.ts';
-export type CIResult = Pick<InstallResult, 'buildQueue' | 'graph'>;
+export type CIResult = Pick<InstallResult, 'buildQueue' | 'graph' | 'skills'>;
 export declare const needsRegistry = true;
 export declare const needsNpmRegistry = true;
 export declare const usage: CommandUsage;

package/dist/commands/ci.js

@@ -1,5 +1,6 @@
 import { install } from '@vltpkg/graph';
 import { commandUsage } from "../config/usage.js";
+import { warnIgnoredWorkspaces } from "../migrate-workspaces.js";
 import { lazyView } from "../view.js";
 export const needsRegistry = true;
 export const needsNpmRegistry = true;
@@ -22,6 +23,10 @@ export const usage = () => commandUsage({
             value: '<query>',
             description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
         },
+        'allow-skills': {
+            value: '<query>',
+            description: "Link agent skills of packages matching this DSS query into the project's agent skill dirs.",
+        },
         'lockfile-only': {
             description: 'Only update lockfile and package.json files; skip node_modules operations.',
         },
@@ -32,15 +37,18 @@ export const views = {
     human: lazyView(async () => (await import('./install/reporter.ts')).InstallReporter),
 };
 export const command = async (conf) => {
+    warnIgnoredWorkspaces(conf);
     const ciOptions = {
         ...conf.options,
         // same default as install: no scripts
         allowScripts: conf.get('allow-scripts') ?? ':not(*)',
+        allowSkills: conf.get('allow-skills'),
+        skillsDirs: conf.get('skills-dir'),
         expectLockfile: true,
         frozenLockfile: true,
         cleanInstall: true,
         lockfileOnly: conf.options['lockfile-only'],
     };
-    const { buildQueue, graph } = await install(ciOptions);
-    return { buildQueue, graph };
+    const { buildQueue, graph, skills } = await install(ciOptions);
+    return { buildQueue, graph, ...(skills ? { skills } : null) };
 };

package/dist/commands/init.js

@@ -4,7 +4,7 @@ import { minimatch } from 'minimatch';
 import { init } from '@vltpkg/init';
 import { install } from '@vltpkg/graph';
 import { load, save } from '@vltpkg/vlt-json';
-import { assertWSConfig, resolveWSConfig, splitNegatedPatterns, } from '@vltpkg/workspaces';
+import { assertWSConfig, migratableWSConfig, resolveWSConfig, splitNegatedPatterns, } from '@vltpkg/workspaces';
 import { commandUsage } from "../config/usage.js";
 export const usage = () => commandUsage({
     command: 'init',
@@ -57,16 +57,15 @@ export const command = async (conf) => {
     if (conf.values.workspace?.length) {
         // the *effective* config, which may come from the root package.json
         // rather than vlt.json
-        const { config: parsedWSConfig, source } = resolveWSConfig(conf.options.projectRoot, conf.options.packageJson);
+        const resolved = resolveWSConfig(conf.options.projectRoot, conf.options.packageJson);
+        const parsedWSConfig = resolved.config;
         // what gets written back to vlt.json. The raw vlt.json value is
         // reused as-is so its existing shape is preserved. When the
-        // definitions live in package.json instead, seed vlt.json with them
-        // first -- otherwise adding a `workspaces` field here would shadow
-        // every workspace package.json already declares.
+        // definitions live in package.json or pnpm-workspace.yaml instead,
+        // seed vlt.json with them first -- otherwise adding a `workspaces`
+        // field here would shadow every workspace already declared there.
         const workspacesConfig = load('workspaces', assertWSConfig) ??
-            (source === 'package.json' ?
-                Object.values(parsedWSConfig).flat()
-                : undefined);
+            migratableWSConfig(resolved);
         const results = [];
         const addToConfig = [];
         // create a new package.json file for every workspace

package/dist/commands/install/reporter.js

@@ -5,6 +5,7 @@ import { createElement as $, Fragment, useEffect, useState, } from 'react';
 import { ViewClass } from "../../view.js";
 import { asError } from '@vltpkg/types';
 import { persistedEntries } from "../../persist-spec-config.js";
+import { keptLine, savedLine, unmatchedLines, unscannedLines, } from "../../allow-skills.js";
 const labels = {
     build: 'resolving dependencies',
     actual: '',
@@ -75,6 +76,17 @@ const App = ({ trailer }) => {
 export class InstallReporter extends ViewClass {
     #instance = null;
     start() {
+        // Ink measures the terminal on every render, and when stdout has no
+        // width (a pipe, a CI log) it does so by spawning `tput cols` and
+        // `tput lines`: thousands of processes over one install. Give a
+        // non-TTY stdout the width Ink would fall back to anyway, so the
+        // output is the same and nothing is spawned.
+        if (!process.stdout.isTTY) {
+            // only a sane COLUMNS counts; -1 or Infinity would be truthy
+            const cols = Number(process.env.COLUMNS);
+            process.stdout.columns ||=
+                Number.isInteger(cols) && cols > 0 ? cols : 80;
+        }
         this.#instance = render($(App));
     }
     async done(_result, { time }) {
@@ -87,12 +99,46 @@ export class InstallReporter extends ViewClass {
             out +=
                 '🔨 Run `vlt build` to run all required scripts to build installed packages.\n';
         }
+        const { linked = [], removed = [], conflicts = [], skipped = [], gitignore = [], unmatched = [], } = _result.skills ?? {};
+        const s = (n) => (n === 1 ? '' : 's');
+        const skills = [];
+        if (linked.length) {
+            // one per skill, linked in any number of dirs
+            const n = new Set(linked.map(r => `${r.id}\0${r.skill}`)).size;
+            const dirs = [...new Set(linked.map(r => r.dir))].join(', ');
+            skills.push(`🔗 Linked ${n} agent skill${s(n)} into ${dirs}`);
+        }
+        if (removed.length) {
+            skills.push(`🧹 Removed ${removed.length} stale skill link${s(removed.length)}: ${removed.join(', ')}`);
+        }
+        if (conflicts.length) {
+            skills.push(`⚠️ ${conflicts.length} skill link${s(conflicts.length)} skipped, path in use or taken by another package: ${conflicts.join(', ')}`);
+        }
+        skills.push(...unmatchedLines(unmatched));
+        if (skipped.length) {
+            skills.push(`⚠️ Skipped ${skipped.join(', ')}`);
+        }
+        if (gitignore.length) {
+            skills.push(`⚠️ Could not update ${gitignore.join(', ')}`);
+        }
+        skills.push(...unscannedLines(_result.skills ?? {}));
+        if (skills.length)
+            out += `\n${skills.join('\n')}\n`;
         const saved = _result.persistedConfig;
         if (saved) {
             for (const e of persistedEntries(saved.values)) {
                 out += `\nSaved ${e} to ${saved.which} vlt.json`;
             }
         }
+        const migrated = _result.migratedWorkspaces;
+        if (migrated) {
+            out += `\nSaved workspaces from ${migrated.source} to vlt.json`;
+        }
+        const a = _result.allowSkills;
+        if (a?.stored)
+            out += `\n${keptLine(a.stored)}`;
+        else if (a)
+            out += `\n${savedLine(a.query, 'project')}`;
         this.#instance?.rerender($(App, { trailer: out }));
         return undefined;
     }

package/dist/commands/install.d.ts

@@ -1,6 +1,8 @@
+import type { AllowSkillsSave } from '../allow-skills.ts';
+import type { MigratedWorkspaces } from '../migrate-workspaces.ts';
 import type { SpecConfigPersistPlan } from '../persist-spec-config.ts';
 import type { DepID } from '@vltpkg/dep-id';
-import type { Diff, Graph } from '@vltpkg/graph';
+import type { Diff, Graph, LinkSkillsResult } from '@vltpkg/graph';
 import type { CommandFn, CommandUsage } from '../index.ts';
 /**
  * The resulting object of an install operation. To be used by the view impl.
@@ -22,12 +24,38 @@ export type InstallResult = {
      * Spec config from the cli / env that was saved to a config file.
      */
     persistedConfig?: SpecConfigPersistPlan;
+    /**
+     * Workspaces saved to vlt.json from package.json or pnpm-workspace.yaml.
+     */
+    migratedWorkspaces?: MigratedWorkspaces;
+    /**
+     * Agent skill links added or removed.
+     */
+    skills?: LinkSkillsResult;
+    /**
+     * `--allow-skills` saved to vlt.json, or kept because another query
+     * is stored.
+     */
+    allowSkills?: AllowSkillsSave;
 };
 export declare const needsRegistry = true;
 export declare const needsNpmRegistry = true;
 export declare const usage: CommandUsage;
 export declare const views: {
     readonly json: (i: InstallResult) => {
+        allowSkills?: AllowSkillsSave | undefined;
+        skills?: {
+            unscanned?: string[];
+            unscannedReason?: "timeout" | "unscanned";
+            removed: string[];
+            conflicts: string[];
+            dirs: string[];
+            skipped?: string[];
+            gitignore?: string[];
+            unmatched?: import("@vltpkg/graph").UnmatchedPattern[];
+            linked: string[];
+        } | undefined;
+        migratedWorkspaces?: MigratedWorkspaces | undefined;
         persistedConfig?: SpecConfigPersistPlan | undefined;
         buildQueue?: DepID[] | undefined;
         message?: string | undefined;

package/dist/commands/install.js

@@ -1,8 +1,11 @@
 import { commandUsage } from "../config/usage.js";
 import { install } from '@vltpkg/graph';
+import { saveAllowSkills } from "../allow-skills.js";
 import { parseAddArgs } from "../parse-add-remove-args.js";
 import { planSpecConfigPersist } from "../persist-spec-config.js";
 import { asUnknownSpecPrefix } from "../require-registry.js";
+import { addTypesDeps } from "../save-types.js";
+import { migrateWorkspaces } from "../migrate-workspaces.js";
 import { trackInstall } from "../telemetry.js";
 import { lazyView } from "../view.js";
 export const needsRegistry = true;
@@ -32,9 +35,15 @@ export const usage = () => commandUsage({
         'save-prod': {
             description: 'Save installed packages to package.json as dependencies.',
         },
+        'save-types': {
+            description: 'Also save matching @types/* packages to devDependencies for added packages that ship no types.',
+        },
         'save-config': {
             description: 'Save registry and git host options given on the command line or via env (e.g. `--registries name=url`) to the project vlt.json, or the user vlt.json with --config=user.',
         },
+        'no-migrate-workspaces': {
+            description: "Don't save workspaces read from package.json or pnpm-workspace.yaml to vlt.json.",
+        },
         workspace: {
             value: '<path|glob>',
             description: 'Limit installation targets to matching workspaces.',
@@ -56,8 +65,17 @@ export const usage = () => commandUsage({
             value: '<query>',
             description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
         },
+        'allow-skills': {
+            value: '<query>',
+            description: "Link agent skills of packages matching this DSS query into the project's agent skill dirs. Saved to vlt.json.",
+        },
     },
 });
+// link mounts; `unchanged` left out
+const skillsJson = ({ linked, unchanged: _, ...rest }) => ({
+    linked: linked.map(s => s.mount),
+    ...rest,
+});
 export const views = {
     json: i => {
         const added = i.diff?.nodes.add ?? new Set();
@@ -119,6 +137,11 @@ export const views = {
             ...(i.persistedConfig ?
                 { persistedConfig: i.persistedConfig }
                 : null),
+            ...(i.migratedWorkspaces ?
+                { migratedWorkspaces: i.migratedWorkspaces }
+                : null),
+            ...(i.skills ? { skills: skillsJson(i.skills) } : null),
+            ...(i.allowSkills ? { allowSkills: i.allowSkills } : null),
         };
     },
     human: lazyView(async () => (await import('./install/reporter.ts')).InstallReporter),
@@ -130,6 +153,8 @@ export const command = async (conf) => {
     const scurry = conf.options.scurry;
     const { add } = parseAddArgs(conf, scurry, monorepo);
     const persist = planSpecConfigPersist(conf);
+    if (conf.values['save-types'])
+        await addTypesDeps(conf, add);
     const frozenLockfile = conf.options['frozen-lockfile'];
     const expectLockfile = conf.options['expect-lockfile'];
     const lockfileOnly = conf.options['lockfile-only'];
@@ -140,20 +165,26 @@ export const command = async (conf) => {
         String(conf.get('allow-scripts'))
         : ':not(*)';
     /* c8 ignore stop */
+    const allowSkills = conf.get('allow-skills');
     const installStart = Date.now();
-    const { buildQueue, graph, diff } = await install({
+    const { buildQueue, graph, diff, skills } = await install({
         ...conf.options,
         frozenLockfile,
         expectLockfile,
         allowScripts,
+        allowSkills,
+        skillsDirs: conf.get('skills-dir'),
         lockfileOnly,
         saveExact,
         savePrefix,
     }, add).catch((er) => {
         throw asUnknownSpecPrefix(er);
     });
+    const migrated = frozenLockfile || expectLockfile ? undefined : (migrateWorkspaces(conf));
     if (persist)
         await conf.addConfigToFile(persist.which, persist.values);
+    // nothing linked on --lockfile-only
+    const allowSkillsSave = lockfileOnly ? undefined : await saveAllowSkills(conf);
     /* c8 ignore next 9 - telemetry is best-effort */
     try {
         trackInstall({
@@ -167,5 +198,8 @@ export const command = async (conf) => {
         graph,
         diff,
         ...(persist ? { persistedConfig: persist } : null),
+        ...(migrated ? { migratedWorkspaces: migrated } : null),
+        ...(skills ? { skills } : null),
+        ...(allowSkillsSave ? { allowSkills: allowSkillsSave } : null),
     };
 };

package/dist/commands/list.js

@@ -1,4 +1,4 @@
-import { actual, asNode, humanReadableOutput, jsonOutput, mermaidOutput, GraphModifier, } from '@vltpkg/graph';
+import { actual, asNode, hasSkills, humanReadableOutput, jsonOutput, mermaidOutput, GraphModifier, } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
 import { SecurityArchive } from '@vltpkg/security-archive';
 import { error } from '@vltpkg/error-cause';
@@ -138,6 +138,7 @@ export const command = async (conf) => {
             securityArchive,
             hostContexts,
             getAuthHeader,
+            hasSkills,
         });
         const { nodes: resultNodes } = await scopeQuery.search(scopeQueryString, {
             signal: new AbortController().signal,
@@ -190,6 +191,7 @@ export const command = async (conf) => {
         securityArchive,
         hostContexts,
         getAuthHeader,
+        hasSkills,
     });
     const query = queryString ||
         /* c8 ignore next */

package/dist/commands/pack.js

@@ -9,6 +9,7 @@ import { actual } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
 import { error } from '@vltpkg/error-cause';
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { sortScopeLocations } from "../sort-scope-locations.js";
 import { minimatch } from 'minimatch';
 export const needsRegistry = true;
 export const usage = () => commandUsage({
@@ -97,7 +98,7 @@ const scopeLocations = async (queryString, conf) => {
         }));
         locations.push(resolve(projectRoot, location));
     }
-    return locations;
+    return sortScopeLocations(locations, options.monorepo);
 };
 export const command = async (conf) => {
     const { options, projectRoot } = conf;

package/dist/commands/pkg.js

@@ -9,6 +9,7 @@ import { SecurityArchive } from '@vltpkg/security-archive';
 import { views as initViews } from "./init.js";
 import { commandUsage } from "../config/usage.js";
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { sortScopeLocations } from "../sort-scope-locations.js";
 import { minimatch } from 'minimatch';
 export const views = {
     human: (results, _, config) => {
@@ -129,15 +130,17 @@ export const command = async (conf) => {
         const { nodes: resultNodes } = await query.search(queryString, {
             signal: new AbortController().signal,
         });
+        const found = [];
         for (const node of resultNodes) {
             const location = node.location;
             assert(location, error(`node ${node.id} has no location`, {
                 found: node,
             }));
             if (node.id !== VIRTUAL_ROOT_ID) {
-                locations.push(resolve(node.projectRoot, location));
+                found.push(resolve(node.projectRoot, location));
             }
         }
+        locations.push(...sortScopeLocations(found, options.monorepo));
     }
     else if (paths?.length || groups?.length || recursive) {
         for (const workspace of options.monorepo ?? []) {

package/dist/commands/publish.d.ts

@@ -1,5 +1,4 @@
 import type { CommandFn, CommandUsage } from '../index.ts';
-export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 export type CommandResultSingle = {
     id: string;