@vltpkg/cli-sdk 1.4.0 → 1.5.0

package/dist/commands/skills.js

@@ -0,0 +1,268 @@
+import { styleText } from 'node:util';
+import { error } from '@vltpkg/error-cause';
+import { assertQuery, linkSkills, listSkills, mermaidOutput, } from '@vltpkg/graph';
+import { configLabel, savedLine, storedAllowSkills, unmatchedLines, unscannedLines, } from "../allow-skills.js";
+import { configWriteTarget } from "../config/index.js";
+import { commandUsage } from "../config/usage.js";
+import { confirm, editQuery, interactive } from "../skills-prompt.js";
+export const needsRegistry = true;
+export const usage = () => commandUsage({
+    command: 'skills',
+    usage: ['', 'list [<query>]', 'link [<query>]'],
+    description: `Manage the agent skills shipped by installed packages.
+
+      A skill is a folder with a \`SKILL.md\` file
+      (https://agentskills.io/specification). Packages ship them as a
+      root \`SKILL.md\`, or at \`<name>/SKILL.md\` in \`skills/\`,
+      \`dist/skills/\` or \`.agents/skills/\`: the first skill of a name
+      wins.
+
+      Skills are linked into the project's agent skill dirs:
+      \`.agents/skills\`, plus \`<folder>/skills\` for each agent folder
+      at the project root (e.g. \`.claude/\`), or the \`skills-dir\`
+      config. When packages ship skills with the same name, one is
+      linked and the others are reported. Only links made by vlt
+      (pointing into \`node_modules/.vlt\`) are ever replaced or
+      removed; anything else in the way is skipped.
+
+      Use --target or a query after the subcommand to select packages
+      using DSS query syntax. End a selector with
+      \`:skill(<name>, …)\` to pick single skills, e.g.
+      \`#skills:skill(find-skills)\`. Use
+      \`vlt install --allow-skills=<query>\` to link skills on install.`,
+    subcommands: {
+        list: {
+            usage: '[<query>]',
+            description: `List the skills of installed packages. The default.
+                      Selects all packages (\`*\`) by default. Applies
+                      \`:skill()\`: preview a query before \`link\` saves
+                      it.`,
+        },
+        link: {
+            usage: '[<query>]',
+            description: `Set, save and apply \`allow-skills\`: link what the
+                      query selects and remove vlt links to other skills.
+                      With no query: the stored one, or
+                      \`:not(:malware)\`. Asks before replacing or editing
+                      a stored query (-y skips). Saves to the project
+                      vlt.json, or the user one with --config=user.`,
+        },
+    },
+    options: {
+        target: {
+            value: '<query>',
+            description: 'Query selector to filter packages using DSS syntax.',
+        },
+        yes: {
+            description: 'Skip the prompts: replace or keep the stored allow-skills without asking.',
+        },
+        config: {
+            value: 'user|project',
+            description: 'vlt.json to save allow-skills to (default: project).',
+        },
+        view: {
+            value: '[human | json | mermaid]',
+            description: 'Output format. mermaid: list only.',
+        },
+    },
+});
+const plural = (n, s) => `${n} ${s}${n === 1 ? '' : 's'}`;
+const lines = (header, items) => [header, ...items.map(i => `  ${i}`)].join('\n');
+// warnings shared by list and link
+const notes = (r) => [
+    ...(r.skipped ? [`⚠️ Skipped ${r.skipped.join(', ')}`] : []),
+    ...(r.gitignore ?
+        [`⚠️ Could not update ${r.gitignore.join(', ')}`]
+        : []),
+    ...unscannedLines(r),
+];
+// `vlt ls` style
+const pkgLabel = (s) => {
+    const pkg = s.version ? `${s.name}@${s.version}` : s.name;
+    return s.alias ? `${s.alias} (${pkg})` : pkg;
+};
+const linkedSuffix = (s, dirs) => dirs.length && dirs.every(d => s.linked.includes(d)) ? ' (linked)'
+    : s.linked.length ? ` (linked in ${s.linked.join(', ')})`
+        : '';
+const row = (s, dirs) => `${s.skill} (${pkgLabel(s)})${linkedSuffix(s, dirs)}`;
+const listNotes = (r) => [
+    ...(!r.dirs.length && !r.skipped ?
+        ['No agent skill dirs: skills-dir is empty']
+        : []),
+    ...notes(r),
+];
+// colors as `vlt ls` / `vlt query`: linked skills = selected nodes
+const humanList = (r, { colors } = {}) => {
+    const style = (format) => (s) => colors ? styleText(format, s, { validateStream: false }) : s;
+    const yellow = style('yellow');
+    const rows = r.skills.map(s => {
+        const x = row(s, r.dirs);
+        return s.linked.length ? yellow(x) : x;
+    });
+    const last = rows.length - 1;
+    return [
+        ...(rows.length ?
+            [
+                style('reset')([
+                    r.project,
+                    ...rows.map((x, i) => `${i === last ? '└──' : '├──'} ${x}`),
+                ].join('\n')),
+            ]
+            : ['No agent skills found in installed packages.']),
+        ...listNotes(r),
+    ].join('\n');
+};
+// the dependency graph down to each package, its skills as leaves
+const mermaidList = (r) => {
+    const children = new Map();
+    for (const s of r.skills) {
+        const list = children.get(s.id) ?? [];
+        list.push({
+            edge: pkgLabel(s),
+            label: `${s.skill}${linkedSuffix(s, r.dirs)}`,
+        });
+        children.set(s.id, list);
+    }
+    const { graph } = r;
+    return [
+        mermaidOutput({
+            edges: [],
+            importers: new Set([graph.mainImporter]),
+            nodes: [...graph.nodes.values()].filter(n => n === graph.mainImporter || children.has(n.id)),
+            children,
+        }),
+        ...listNotes(r).map(n => `%% ${n}`),
+    ].join('\n');
+};
+// `name`: the skill, `dependency-name`: the dep it's installed as,
+// `package-id`: its package
+const jsonSkill = ({ skill, name, alias, version, id, description, ...rest }) => ({
+    name: skill,
+    description,
+    'dependency-name': alias ?? name,
+    'package-id': id,
+    ...rest,
+});
+// distinct skills, in any number of dirs
+const count = (rows) => new Set(rows.map(r => `${r.id}\0${r.skill}`)).size;
+const humanLink = (r) => {
+    const out = [];
+    if (r.linked.length) {
+        out.push(lines(`🔗 Linked ${plural(count(r.linked), 'agent skill')}:`, r.linked.map(s => s.mount)));
+    }
+    else if (r.unchanged.length) {
+        out.push(`${plural(count(r.unchanged), 'agent skill')} already linked.`);
+    }
+    if (r.removed.length) {
+        out.push(lines(`🧹 Removed ${plural(r.removed.length, 'skill link')}:`, r.removed));
+    }
+    if (r.conflicts.length) {
+        out.push(lines(`⚠️ Skipped ${plural(r.conflicts.length, 'skill')}, path in use or taken by another package:`, r.conflicts));
+    }
+    out.push(...notes(r));
+    return out.join('\n') || 'No agent skills found to link.';
+};
+const human = (r, o) => r.action === 'list' ? humanList(r, o)
+    : r.action === 'unchanged' ? 'No changes made.'
+        : [
+            humanLink(r),
+            ...unmatchedLines(r.unmatched),
+            ...(r.saved ? [savedLine(r.query, r.saved)] : []),
+        ].join('\n');
+export const views = {
+    human,
+    json: (r) => {
+        if (r.action !== 'list')
+            return r;
+        // key order kept
+        const { project, graph, ...rest } = r;
+        return { ...rest, skills: rest.skills.map(jsonSkill) };
+    },
+    mermaid: (r) => r.action === 'list' ? mermaidList(r) : human(r),
+};
+const defaultQuery = ':not(:malware)';
+const where = (which) => which === 'user' ?
+    'in the user vlt.json'
+    : 'for this project (vlt.json)';
+// the query to link; undefined: no changes
+const pickQuery = async (conf, given) => {
+    const check = (q) => assertQuery(q, 'allow-skills', ['skill']);
+    const stored = storedAllowSkills(conf);
+    const yes = !!conf.get('yes');
+    const tty = interactive();
+    if (given) {
+        await check(given);
+        if (!stored || stored.query === given || yes)
+            return given;
+        if (!tty) {
+            throw error(`allow-skills is already set (${configLabel(stored.which)}): "${stored.query}"; pass -y to replace it`, { code: 'EUSAGE', found: given, wanted: stored.query });
+        }
+        if (!(await confirm(`allow-skills is already set ${where(stored.which)}: "${stored.query}". Replace it? [y/N] `))) {
+            return undefined;
+        }
+        return editQuery({ current: stored.query, prefill: given, check });
+    }
+    if (stored) {
+        if (yes || !tty)
+            return stored.query;
+        const edit = await confirm(`allow-skills is set ${where(stored.which)}: "${stored.query}". Edit it? [y/N] `);
+        // ctrl+C/D: cancel
+        if (edit === undefined)
+            return undefined;
+        return edit ?
+            editQuery({
+                current: stored.query,
+                prefill: stored.query,
+                check,
+            })
+            : stored.query;
+    }
+    if (yes || !tty)
+        return defaultQuery;
+    return editQuery({ prefill: defaultQuery, check });
+};
+export const command = async (conf) => {
+    const [sub = 'list', query] = conf.positionals;
+    const target = conf.get('target') || query;
+    const opts = {
+        ...conf.options,
+        projectRoot: conf.projectRoot,
+        skillsDirs: conf.get('skills-dir'),
+    };
+    switch (sub) {
+        case 'list':
+        case 'ls':
+            return {
+                action: 'list',
+                ...(await listSkills({ ...opts, target })),
+            };
+        case 'link': {
+            const query = await pickQuery(conf, target);
+            if (query === undefined)
+                return { action: 'unchanged' };
+            const res = await linkSkills({
+                ...opts,
+                target: query,
+                apply: true,
+            });
+            // after linking: a link error saves nothing
+            let saved;
+            if (storedAllowSkills(conf)?.query !== query) {
+                saved = configWriteTarget(conf, 'project');
+                await conf.addConfigToFile(saved, { 'allow-skills': query });
+            }
+            return {
+                action: 'link',
+                query,
+                ...(saved && { saved }),
+                ...res,
+            };
+        }
+        default:
+            throw error('Unknown skills subcommand', {
+                code: 'EUSAGE',
+                found: sub,
+                validOptions: ['list', 'ls', 'link'],
+            });
+    }
+};

package/dist/commands/uninstall.d.ts

@@ -1,10 +1,14 @@
-import type { Graph } from '@vltpkg/graph';
+import type { Graph, LinkSkillsResult } from '@vltpkg/graph';
 import type { CommandFn, CommandUsage } from '../index.ts';
 export type UninstallResult = {
     /**
      * The resulting graph structure at the end of an uninstall.
      */
     graph: Graph;
+    /**
+     * Agent skill links added or removed.
+     */
+    skills?: LinkSkillsResult;
 };
 export declare const needsRegistry = true;
 export declare const needsNpmRegistry = true;

package/dist/commands/uninstall.js

@@ -39,10 +39,12 @@ export const command = async (conf) => {
         String(conf.get('allow-scripts'))
         : ':not(*)';
     /* c8 ignore stop */
-    const { graph } = await uninstall({
+    const { graph, skills } = await uninstall({
         ...conf.options,
         allowScripts,
+        allowSkills: conf.get('allow-skills'),
+        skillsDirs: conf.get('skills-dir'),
         lockfileOnly: conf.options['lockfile-only'],
     }, remove);
-    return { graph };
+    return { graph, ...(skills ? { skills } : null) };
 };

package/dist/commands/unpublish.d.ts

@@ -1,5 +1,4 @@
 import type { CommandFn, CommandUsage } from '../index.ts';
-export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 export type CommandResult = {
     /** The package name */

package/dist/commands/unpublish.js

@@ -1,9 +1,10 @@
 import { error } from '@vltpkg/error-cause';
-import { RegistryClient, assertOk, requestError, } from '@vltpkg/registry-client';
+import { RegistryClient, assertOk, registryBase, requestError, } from '@vltpkg/registry-client';
 import { Spec } from '@vltpkg/spec';
+import { dirname } from 'node:path';
 import { commandUsage } from "../config/usage.js";
+import { getPublishConfig } from "../publish-config.js";
 import { resolveRegistry } from "../require-registry.js";
-export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'unpublish',
     usage: ['<package>@<version>', '<package> --force'],
@@ -11,6 +12,8 @@ export const usage = () => commandUsage({
 
     To unpublish a single version, specify the package name and version.
     To unpublish an entire package, specify the package name and use --force.
+    A spec naming the package in the current directory uses its
+    \`publishConfig.registry\`, if set.
 
     ⚠️  Unpublishing is a destructive action that cannot be undone.
     Consider using \`vlt deprecate\` instead if you want to discourage
@@ -45,14 +48,22 @@ export const views = {
     },
     json: (r) => r,
 };
+/** `publishConfig.registry` of the local package, if it is `name` */
+const localPublishRegistry = (conf, name) => {
+    const path = conf.options.packageJson.find(process.cwd());
+    if (!path)
+        return undefined;
+    const manifest = conf.options.packageJson.read(dirname(path));
+    return manifest.name === name ?
+        getPublishConfig(manifest)?.registry
+        : undefined;
+};
 export const command = async (conf) => {
     const specArg = conf.positionals[0];
     if (!specArg) {
         throw error('unpublish requires a package spec argument (e.g. pkg@version)', { code: 'EUSAGE' });
     }
     const { otp, force } = conf.options;
-    const registry = await resolveRegistry(conf);
-    const registryUrl = new URL(registry);
     const spec = Spec.parseArgs(specArg, conf.options);
     const name = spec.name;
     /* c8 ignore start - Spec.parseArgs always produces a name for valid input */
@@ -71,6 +82,8 @@ export const command = async (conf) => {
                 'To unpublish all versions, use: vlt unpublish <package> --force');
         }
     }
+    const registryUrl = new URL(registryBase(localPublishRegistry(conf, name) ??
+        (await resolveRegistry(conf))));
     const rc = new RegistryClient(conf.options);
     const encodedName = name.startsWith('@') ? name.replace('/', '%2F') : name;
     if (version) {

package/dist/commands/update.d.ts

@@ -5,6 +5,18 @@ export declare const needsNpmRegistry = true;
 export declare const usage: CommandUsage;
 export declare const views: {
     readonly json: (i: InstallResult) => {
+        allowSkills?: import("../allow-skills.ts").AllowSkillsSave | undefined;
+        skills?: {
+            unscanned?: string[];
+            unscannedReason?: "timeout" | "unscanned";
+            removed: string[];
+            conflicts: string[];
+            dirs: string[];
+            skipped?: string[];
+            gitignore?: string[];
+            unmatched?: import("@vltpkg/graph").UnmatchedPattern[];
+            linked: string[];
+        } | undefined;
         persistedConfig?: import("../persist-spec-config.ts").SpecConfigPersistPlan | undefined;
         graph: import("@vltpkg/graph").LockfileData;
         buildQueue?: import("@vltpkg/dep-id").DepID[] | undefined;

package/dist/commands/update.js

@@ -1,6 +1,7 @@
 import { update } from '@vltpkg/graph';
 import { error } from '@vltpkg/error-cause';
 import { commandUsage } from "../config/usage.js";
+import { saveAllowSkills } from "../allow-skills.js";
 import { planSpecConfigPersist } from "../persist-spec-config.js";
 import { asUnknownSpecPrefix } from "../require-registry.js";
 import { lazyView } from "../view.js";
@@ -28,8 +29,17 @@ export const usage = () => commandUsage({
             value: '<query>',
             description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
         },
+        'allow-skills': {
+            value: '<query>',
+            description: "Link agent skills of packages matching this DSS query into the project's agent skill dirs. Saved to vlt.json.",
+        },
     },
 });
+// link mounts; `unchanged` left out
+const skillsJson = ({ linked, unchanged: _, ...rest }) => ({
+    linked: linked.map(s => s.mount),
+    ...rest,
+});
 export const views = {
     json: i => ({
         ...(i.buildQueue?.length ?
@@ -42,6 +52,8 @@ export const views = {
         ...(i.persistedConfig ?
             { persistedConfig: i.persistedConfig }
             : null),
+        ...(i.skills ? { skills: skillsJson(i.skills) } : null),
+        ...(i.allowSkills ? { allowSkills: i.allowSkills } : null),
     }),
     human: lazyView(async () => (await import('./install/reporter.ts')).InstallReporter),
 };
@@ -58,17 +70,22 @@ export const command = async (conf) => {
         String(conf.get('allow-scripts'))
         : ':not(*)';
     /* c8 ignore stop */
-    const { buildQueue, graph } = await update({
+    const { buildQueue, graph, skills } = await update({
         ...conf.options,
         allowScripts,
+        allowSkills: conf.get('allow-skills'),
+        skillsDirs: conf.get('skills-dir'),
     }).catch((er) => {
         throw asUnknownSpecPrefix(er);
     });
     if (persist)
         await conf.addConfigToFile(persist.which, persist.values);
+    const allowSkillsSave = await saveAllowSkills(conf);
     return {
         buildQueue,
         graph,
         ...(persist ? { persistedConfig: persist } : null),
+        ...(skills ? { skills } : null),
+        ...(allowSkillsSave ? { allowSkills: allowSkillsSave } : null),
     };
 };

package/dist/config/definition.d.ts

@@ -53,6 +53,7 @@ export declare const commands: {
     readonly 'run-exec': "run-exec";
     readonly run: "run";
     readonly setup: "setup";
+    readonly skills: "skills";
     readonly token: "token";
     readonly uninstall: "uninstall";
     readonly unpublish: "unpublish";
@@ -371,6 +372,10 @@ export declare const definition: import("jackspeak").Jack<{
     'save-config': {
         description: string;
     };
+    'migrate-workspaces': {
+        description: string;
+        default: true;
+    };
 } & {
     'save-dev': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'save-exact': import("jackspeak").ConfigOption<"boolean", false, undefined>;
@@ -379,6 +384,7 @@ export declare const definition: import("jackspeak").Jack<{
     'save-prod': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'save-types': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'save-config': import("jackspeak").ConfigOption<"boolean", false, undefined>;
+    'migrate-workspaces': import("jackspeak").ConfigOption<"boolean", false, undefined>;
 } & {
     'save-prefix': {
         description: string;
@@ -429,6 +435,20 @@ export declare const definition: import("jackspeak").Jack<{
     };
 } & {
     'allow-scripts': import("jackspeak").ConfigOption<"string", false, readonly string[] | undefined>;
+} & {
+    'allow-skills': {
+        hint: string;
+        description: string;
+    };
+} & {
+    'allow-skills': import("jackspeak").ConfigOption<"string", false, readonly string[] | undefined>;
+} & {
+    'skills-dir': {
+        hint: string;
+        description: string;
+    };
+} & {
+    'skills-dir': import("jackspeak").ConfigOption<"string", true, readonly string[] | undefined>;
 } & {
     access: {
         description: string;

package/dist/config/definition.js

@@ -46,6 +46,7 @@ const canonicalCommands = {
     'run-exec': 'run-exec',
     run: 'run',
     setup: 'setup',
+    skills: 'skills',
     token: 'token',
     uninstall: 'uninstall',
     unpublish: 'unpublish',
@@ -525,7 +526,9 @@ export const definition = j
     config: {
         hint: 'all | user | project',
         description: `Specify which configuration to show or operate on when running
-                    \`vlt config\` commands. For read operations (get, pick, list):
+                    \`vlt config\` commands, and which file
+                    \`vlt skills link\` saves \`allow-skills\` to. For read
+                    operations (get, pick, list):
                     \`all\` shows merged configuration from both user and project
                     files (default). For write operations (set, delete, edit):
                     defaults to \`project\`. \`user\` shows/modifies only user-level
@@ -729,6 +732,17 @@ export const definition = j
                     \`add\` or \`update\`. Values a config file already
                     has are left alone.`,
     },
+    'migrate-workspaces': {
+        description: `Save workspaces read from the \`workspaces\` field of
+                    the root \`package.json\` or from
+                    \`pnpm-workspace.yaml\` to the project \`vlt.json\` on
+                    \`vlt install\`. \`vlt.json\` then takes precedence.
+
+                    Set \`--no-migrate-workspaces\` to skip this; an
+                    already saved \`workspaces\` field stays until
+                    removed.`,
+        default: true,
+    },
 })
     .opt({
     'save-prefix': {
@@ -796,6 +810,40 @@ export const definition = j
                     Runs scripts only for direct dependencies of the current project and any occurrences
                     of a specific dependency with the name "my-package" anywhere in the dependency graph.`,
     },
+})
+    .opt({
+    'allow-skills': {
+        hint: 'query',
+        description: `Link the agent skills (folders with a \`SKILL.md\`) shipped by
+                    installed packages matching this DSS query into
+                    the project's agent skill dirs (see \`skills-dir\`)
+                    after \`install\`, \`ci\`, \`update\` or
+                    \`uninstall\`. End a selector with
+                    \`:skill(<name>, …)\` to pick single skills (\`*\`
+                    globs, double-quoted names). Unset (the default) or
+                    \`:not(*)\` links nothing and skips all skills work.
+
+                    \`vlt install --allow-skills=<query>\` saves the query
+                    to the project \`vlt.json\`; \`vlt skills link
+                    [<query>]\` sets, saves and applies it.
+
+                    Example: --allow-skills="#agent-browser:skill(agent-browser)"
+                    Links the agent-browser skill from a package with the same name.`,
+    },
+})
+    .optList({
+    'skills-dir': {
+        hint: 'path',
+        description: `Dirs to link agent skills into (see \`allow-skills\`),
+                    relative to the project root. Replaces detection:
+                    \`.agents/skills\`, plus \`<folder>/skills\` for each
+                    agent folder at the project root (e.g. \`.claude/\`),
+                    \`.claude/skills\` inside Claude Code, and existing
+                    \`.<name>/skills\` dirs. An empty list (\`[]\` in
+                    vlt.json, or \`--skills-dir=\`) links nothing. Each
+                    dir must be inside the project, not in
+                    node_modules.`,
+    },
 })
     .opt({
     access: {

package/dist/custom-help.js

@@ -183,6 +183,10 @@ const commandHelp = {
         desc: 'Configure your vlt.io account registries',
         defaultOrder: 0,
     },
+    skills: {
+        args: '[list|link]',
+        desc: 'Manage agent skills from installed packages',
+    },
     token: {
         args: '[add|rm]',
         desc: 'Manage authentication tokens',

package/dist/index.js

@@ -1,5 +1,6 @@
 import { format } from 'node:util';
 import { asRootError, findRootError } from '@vltpkg/output/error';
+import { setVltJsonOnly } from '@vltpkg/workspaces';
 import { loadPackageJson } from 'package-json-from-dist';
 import { getSortedCliOptions, getSortedKeys, } from "./config/definition.js";
 import { Config } from "./config/index.js";
@@ -49,6 +50,8 @@ const run = async () => {
     if (vlt.get('version')) {
         return stdout(version);
     }
+    // ci reads workspaces from vlt.json only; set before options load
+    setVltJsonOnly(vlt.command === 'ci');
     const { monorepo } = vlt.options;
     // Infer the workspace by being in that directory.
     if (vlt.get('workspace') === undefined) {
@@ -61,7 +64,10 @@ const run = async () => {
     if (vlt.command !== 'init' &&
         (vlt.get('workspace') || vlt.get('workspace-group')) &&
         ![...(monorepo?.values() ?? [])].length) {
-        stderr(`Error: No matching workspaces found. Make sure the vlt.json config, the "workspaces" field of the root package.json, or the "packages" list of pnpm-workspace.yaml contains the correct workspaces.`);
+        const where = vlt.command === 'ci' ?
+            'the vlt.json config (vlt ci ignores package.json and pnpm-workspace.yaml)'
+            : 'the vlt.json config, the "workspaces" field of the root package.json, or the "packages" list of pnpm-workspace.yaml';
+        stderr(`Error: No matching workspaces found. Make sure ${where} contains the correct workspaces.`);
         if (vlt.get('workspace')) {
             stderr(indent(`Workspace: ${format(vlt.get('workspace'))}`));
         }

package/dist/load-command.d.ts

@@ -15,6 +15,8 @@ export type Command<T> = {
      * Set to `true` by commands that hit a registry or resolve registry
      * specs. There is no default registry, so `outputCommand()` fails
      * early with an `ECONFIG` error when one of these runs unconfigured.
+     * `publish`/`unpublish` check in-command instead, since
+     * `publishConfig.registry` may suffice.
      */
     needsRegistry?: boolean;
     /**

package/dist/migrate-workspaces.d.ts

@@ -0,0 +1,16 @@
+import type { WorkspaceConfigSource } from '@vltpkg/workspaces';
+import type { LoadedConfig } from './config/index.ts';
+export type MigratedWorkspaces = {
+    source: WorkspaceConfigSource;
+    workspaces: string[];
+};
+/**
+ * Save workspaces read from `package.json` or `pnpm-workspace.yaml` to
+ * the project `vlt.json`, unless `--no-migrate-workspaces`.
+ */
+export declare const migrateWorkspaces: (conf: LoadedConfig) => MigratedWorkspaces | undefined;
+/**
+ * Warn when workspaces are declared only outside `vlt.json`, which
+ * `vlt ci` ignores.
+ */
+export declare const warnIgnoredWorkspaces: (conf: LoadedConfig) => void;

package/dist/migrate-workspaces.js

@@ -0,0 +1,44 @@
+import { save } from '@vltpkg/vlt-json';
+import { migratableWSConfig, resolveWSConfig, } from '@vltpkg/workspaces';
+import { stderr } from "./output.js";
+// workspaces declared outside vlt.json, if any
+const found = (conf) => {
+    const resolved = resolveWSConfig(conf.options.projectRoot, conf.options.packageJson, false);
+    const workspaces = migratableWSConfig(resolved);
+    const { source } = resolved;
+    if (!workspaces?.length || !source)
+        return;
+    return { source, workspaces };
+};
+/**
+ * Save workspaces read from `package.json` or `pnpm-workspace.yaml` to
+ * the project `vlt.json`, unless `--no-migrate-workspaces`.
+ */
+export const migrateWorkspaces = (conf) => {
+    if (!conf.options['migrate-workspaces'])
+        return;
+    const migrated = found(conf);
+    if (migrated)
+        save('workspaces', migrated.workspaces);
+    return migrated;
+};
+/**
+ * Warn when workspaces are declared only outside `vlt.json`, which
+ * `vlt ci` ignores.
+ */
+export const warnIgnoredWorkspaces = (conf) => {
+    const { loglevel } = conf.values;
+    if (loglevel === 'silent' || loglevel === 'error')
+        return;
+    let migrated;
+    try {
+        migrated = found(conf);
+    }
+    catch {
+        // invalid workspaces config: nothing to suggest
+        return;
+    }
+    if (!migrated)
+        return;
+    stderr(`Warning: vlt ci reads workspaces from vlt.json only; ignoring ${migrated.source}, its workspaces are not installed. Run \`vlt install\` to save them to vlt.json, or add them there.`);
+};