npm - @anytio/pspm - Versions diffs - 0.1.0 → 0.2.0 - Mend

@anytio/pspm 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/index.js CHANGED Viewed

@@ -1,113 +1,15 @@
 #!/usr/bin/env node
-import { readFileSync } from 'fs';
-import { dirname, join, basename, relative } from 'path';
-import { fileURLToPath, URL as URL$1 } from 'url';
-import { Command } from 'commander';
-import { createHash, randomBytes } from 'crypto';
-import * as semver from 'semver';
-import { stat, writeFile, readdir, mkdir, rm, rename, access as access$1, readFile, lstat, cp, unlink, readlink, symlink } from 'fs/promises';
-import { homedir } from 'os';
-import * as ini from 'ini';
-import { checkbox } from '@inquirer/prompts';
-import { createInterface } from 'readline';
-import http from 'http';
-import open from 'open';
-import { exec as exec$1 } from 'child_process';
-import { promisify } from 'util';
-function calculateIntegrity(data) {
-  const hash = createHash("sha256").update(data).digest("base64");
-  return `sha256-${hash}`;
-}
-// ../../packages/shared/pspm-types/src/manifest.ts
-var DEFAULT_SKILL_FILES = [
-  "SKILL.md",
-  "runtime",
-  "scripts",
-  "data"
-];
-var PSPM_SCHEMA_URL = "https://pspm.dev/schema/v1/pspm.json";
-function validateManifest(manifest) {
-  if (!manifest.name) {
-    return { valid: false, error: "Manifest must have a 'name' field" };
-  }
-  if (!manifest.version) {
-    return { valid: false, error: "Manifest must have a 'version' field" };
-  }
-  if (!/^[a-z][a-z0-9_-]*$/.test(manifest.name)) {
-    return {
-      valid: false,
-      error: "Name must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores"
-    };
-  }
-  if (!/^\d+\.\d+\.\d+/.test(manifest.version)) {
-    return {
-      valid: false,
-      error: "Version must be a valid semantic version (e.g., 1.0.0)"
-    };
-  }
-  return { valid: true };
-}
-// ../../packages/shared/pspm-types/src/specifier.ts
-var SPECIFIER_PATTERN = /^@user\/([a-zA-Z0-9_-]+)\/([a-z][a-z0-9_-]*)(?:@(.+))?$/;
-function parseSkillSpecifier(specifier) {
-  const match = specifier.match(SPECIFIER_PATTERN);
-  if (!match) {
-    return null;
-  }
-  return {
-    username: match[1],
-    name: match[2],
-    versionRange: match[3]
-  };
-}
-var GITHUB_SPECIFIER_PATTERN = /^github:([a-zA-Z0-9_-]+)\/([a-zA-Z0-9_.-]+)(\/[^@]+)?(?:@(.+))?$/;
-function parseGitHubSpecifier(specifier) {
-  const match = specifier.match(GITHUB_SPECIFIER_PATTERN);
-  if (!match) {
-    return null;
-  }
-  const [, owner, repo, pathWithSlash, ref] = match;
-  return {
-    owner,
-    repo,
-    // Remove leading slash from path
-    path: pathWithSlash ? pathWithSlash.slice(1) : void 0,
-    ref: ref || void 0
-  };
-}
-function formatGitHubSpecifier(spec) {
-  let result = `github:${spec.owner}/${spec.repo}`;
-  if (spec.path) {
-    result += `/${spec.path}`;
-  }
-  if (spec.ref) {
-    result += `@${spec.ref}`;
-  }
-  return result;
-}
-function getGitHubSkillName(spec) {
-  if (spec.path) {
-    const segments = spec.path.split("/").filter(Boolean);
-    return segments[segments.length - 1];
-  }
-  return spec.repo;
-}
-function isGitHubSpecifier(specifier) {
-  return specifier.startsWith("github:");
-}
-function resolveVersion(range, availableVersions) {
-  const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
-  if (!range || range === "latest" || range === "*") {
-    return sorted[0] ?? null;
-  }
-  return semver.maxSatisfying(sorted, range);
-}
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
-// ../../packages/sdk/src/fetchers/cli-fetcher.ts
-var config = null;
+// src/sdk/fetcher.ts
 function configure(options) {
   config = options;
 }
@@ -146,84 +48,87 @@ async function customFetch(url, options) {
     headers: response.headers
   };
 }
+var config;
+var init_fetcher = __esm({
+  "src/sdk/fetcher.ts"() {
+    "use strict";
+    config = null;
+  }
+});
-// ../../packages/sdk/src/generated/fetch/index.ts
-var getMeUrl = () => {
-  return `/api/skills/me`;
-};
-var me = async (options) => {
-  return customFetch(
-    getMeUrl(),
-    {
-      ...options,
-      method: "GET"
-    }
-  );
-};
-var getListSkillVersionsUrl = (username, name) => {
-  return `/api/skills/@user/${username}/${name}/versions`;
-};
-var listSkillVersions = async (username, name, options) => {
-  return customFetch(
-    getListSkillVersionsUrl(username, name),
-    {
-      ...options,
-      method: "GET"
-    }
-  );
-};
-var getGetSkillVersionUrl = (username, name, version2) => {
-  return `/api/skills/@user/${username}/${name}/${version2}`;
-};
-var getSkillVersion = async (username, name, version2, options) => {
-  return customFetch(
-    getGetSkillVersionUrl(username, name, version2),
-    {
-      ...options,
-      method: "GET"
-    }
-  );
-};
-var getPublishSkillUrl = () => {
-  return `/api/skills/publish`;
-};
-var publishSkill = async (publishSkillInput, options) => {
-  return customFetch(
-    getPublishSkillUrl(),
-    {
-      ...options,
-      method: "POST",
-      headers: { "Content-Type": "application/json", ...options?.headers },
-      body: JSON.stringify(
-        publishSkillInput
-      )
-    }
-  );
-};
-var getDeleteSkillUrl = (name) => {
-  return `/api/skills/${name}`;
-};
-var deleteSkill = async (name, options) => {
-  return customFetch(
-    getDeleteSkillUrl(name),
-    {
-      ...options,
-      method: "DELETE"
-    }
-  );
-};
-var getDeleteSkillVersionUrl = (name, version2) => {
-  return `/api/skills/${name}/${version2}`;
-};
-var deleteSkillVersion = async (name, version2, options) => {
-  return customFetch(
-    getDeleteSkillVersionUrl(name, version2),
-    {
-      ...options,
-      method: "DELETE"
-    }
-  );
-};
+// src/sdk/generated/index.ts
+var getMeUrl, me, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getPublishSkillUrl, publishSkill, getDeleteSkillUrl, deleteSkill, getDeleteSkillVersionUrl, deleteSkillVersion;
+var init_generated = __esm({
+  "src/sdk/generated/index.ts"() {
+    "use strict";
+    init_fetcher();
+    getMeUrl = () => {
+      return "/api/skills/me";
+    };
+    me = async (options) => {
+      return customFetch(getMeUrl(), {
+        ...options,
+        method: "GET"
+      });
+    };
+    getListSkillVersionsUrl = (username, name) => {
+      return `/api/skills/@user/${username}/${name}/versions`;
+    };
+    listSkillVersions = async (username, name, options) => {
+      return customFetch(
+        getListSkillVersionsUrl(username, name),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
+    };
+    getGetSkillVersionUrl = (username, name, version2) => {
+      return `/api/skills/@user/${username}/${name}/${version2}`;
+    };
+    getSkillVersion = async (username, name, version2, options) => {
+      return customFetch(
+        getGetSkillVersionUrl(username, name, version2),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
+    };
+    getPublishSkillUrl = () => {
+      return "/api/skills/publish";
+    };
+    publishSkill = async (publishSkillInput, options) => {
+      return customFetch(getPublishSkillUrl(), {
+        ...options,
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...options?.headers },
+        body: JSON.stringify(publishSkillInput)
+      });
+    };
+    getDeleteSkillUrl = (name) => {
+      return `/api/skills/${name}`;
+    };
+    deleteSkill = async (name, options) => {
+      return customFetch(getDeleteSkillUrl(name), {
+        ...options,
+        method: "DELETE"
+      });
+    };
+    getDeleteSkillVersionUrl = (name, version2) => {
+      return `/api/skills/${name}/${version2}`;
+    };
+    deleteSkillVersion = async (name, version2, options) => {
+      return customFetch(
+        getDeleteSkillVersionUrl(name, version2),
+        {
+          ...options,
+          method: "DELETE"
+        }
+      );
+    };
+  }
+});
 // src/api-client.ts
 function registryUrlToBaseUrl(registryUrl) {
@@ -345,28 +250,21 @@ async function changeSkillAccess(skillName, input) {
     };
   }
 }
+var init_api_client = __esm({
+  "src/api-client.ts"() {
+    "use strict";
+    init_fetcher();
+    init_generated();
+  }
+});
 // src/errors.ts
-var ConfigError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ConfigError";
-  }
-};
-var NotLoggedInError = class extends ConfigError {
-  constructor() {
-    super(
-      "Not logged in. Run 'pspm login --api-key <key>' first, or set PSPM_API_KEY env var."
-    );
-    this.name = "NotLoggedInError";
-  }
-};
 function extractApiErrorMessage(response, fallbackMessage) {
   const errorData = response.data;
   if (process.env.PSPM_DEBUG) {
     console.log(`[debug] API response status: ${response.status}`);
     console.log(
-      `[debug] API response data:`,
+      "[debug] API response data:",
       JSON.stringify(errorData, null, 2)
     );
   }
@@ -395,9 +293,32 @@ ${issueMessages}`;
   }
   return errorMessage;
 }
+var ConfigError, NotLoggedInError;
+var init_errors = __esm({
+  "src/errors.ts"() {
+    "use strict";
+    ConfigError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ConfigError";
+      }
+    };
+    NotLoggedInError = class extends ConfigError {
+      constructor() {
+        super(
+          "Not logged in. Run 'pspm login --api-key <key>' first, or set PSPM_API_KEY env var."
+        );
+        this.name = "NotLoggedInError";
+      }
+    };
+  }
+});
 // src/config.ts
-var DEFAULT_REGISTRY_URL = "https://pspm.dev";
+import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import * as ini from "ini";
 function getConfigPath() {
   return join(homedir(), ".pspmrc");
 }
@@ -431,7 +352,7 @@ async function readUserConfig() {
     const content = await readFile(configPath, "utf-8");
     const parsed = ini.parse(content);
     if (process.env.PSPM_DEBUG) {
-      console.log(`[config] Parsed config:`, JSON.stringify(parsed, null, 2));
+      console.log("[config] Parsed config:", JSON.stringify(parsed, null, 2));
     }
     const scopedRegistries = {};
     for (const key of Object.keys(parsed)) {
@@ -592,7 +513,7 @@ async function resolveConfig() {
     apiKey = process.env.PSPM_API_KEY;
   }
   if (process.env.PSPM_DEBUG) {
-    console.log(`[config] Resolved config:`);
+    console.log("[config] Resolved config:");
     console.log(`[config]   registryUrl: ${registryUrl}`);
     console.log(`[config]   apiKey: ${apiKey ? "***" : "(not set)"}`);
     console.log(`[config]   username: ${username || "(not set)"}`);
@@ -636,8 +557,8 @@ async function setCredentials(authToken, username, registry) {
 }
 async function clearCredentials() {
   const config2 = await readUserConfig();
-  delete config2.authToken;
-  delete config2.username;
+  config2.authToken = void 0;
+  config2.username = void 0;
   await writeUserConfig(config2);
 }
 async function isLoggedIn() {
@@ -652,7 +573,7 @@ async function requireApiKey() {
   const resolved = await resolveConfig();
   if (!resolved.apiKey) {
     if (process.env.PSPM_DEBUG) {
-      console.log(`[config] requireApiKey: No API key found`);
+      console.log("[config] requireApiKey: No API key found");
     }
     throw new NotLoggedInError();
   }
@@ -667,131 +588,146 @@ async function getRegistryUrl() {
   const resolved = await resolveConfig();
   return resolved.registryUrl;
 }
+var DEFAULT_REGISTRY_URL;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_errors();
+    DEFAULT_REGISTRY_URL = "https://pspm.dev";
+  }
+});
-// src/commands/access.ts
-async function access(specifier, options) {
-  try {
-    const apiKey = await requireApiKey();
-    const registryUrl = await getRegistryUrl();
-    if (options.public && options.private) {
-      console.error("Error: Cannot specify both --public and --private");
-      process.exit(1);
-    }
-    if (!options.public && !options.private) {
-      console.error("Error: Must specify either --public or --private");
-      process.exit(1);
-    }
-    const visibility = options.public ? "public" : "private";
-    let packageName;
-    if (specifier) {
-      const parsed = parseSkillSpecifier(specifier);
-      if (!parsed) {
-        console.error(
-          `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}`
-        );
-        process.exit(1);
-      }
-      packageName = parsed.name;
-    } else {
-      const { readFile: readFile7 } = await import('fs/promises');
-      const { join: join13 } = await import('path');
-      let manifest = null;
-      try {
-        const content = await readFile7(
-          join13(process.cwd(), "pspm.json"),
-          "utf-8"
-        );
-        manifest = JSON.parse(content);
-      } catch {
-        try {
-          const content = await readFile7(
-            join13(process.cwd(), "package.json"),
-            "utf-8"
-          );
-          manifest = JSON.parse(content);
-        } catch {
-          console.error(
-            "Error: No pspm.json or package.json found in current directory"
-          );
-          console.error(
-            "Either run this command in a package directory or specify a package name"
-          );
-          process.exit(1);
-        }
-      }
-      if (!manifest?.name) {
-        console.error("Error: Package manifest is missing 'name' field");
-        process.exit(1);
-      }
-      packageName = manifest.name;
-    }
-    configure2({ registryUrl, apiKey });
-    console.log(`Setting ${packageName} to ${visibility}...`);
-    const response = await changeSkillAccess(packageName, { visibility });
-    if (response.status !== 200 || !response.data) {
-      const errorMessage = response.error ?? "Failed to change visibility";
-      console.error(`Error: ${errorMessage}`);
-      process.exit(1);
-    }
-    const result = response.data;
-    console.log(
-      `+ @user/${result.username}/${result.name} is now ${result.visibility}`
-    );
-    if (visibility === "public") {
-      console.log("");
-      console.log(
-        "Note: This action is irreversible. Public packages cannot be made private."
-      );
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Unknown error";
-    console.error(`Error: ${message}`);
-    process.exit(1);
+// src/lib/integrity.ts
+import { createHash } from "crypto";
+function calculateIntegrity(data) {
+  const hash = createHash("sha256").update(data).digest("base64");
+  return `sha256-${hash}`;
+}
+var init_integrity = __esm({
+  "src/lib/integrity.ts"() {
+    "use strict";
+  }
+});
+// src/lib/manifest.ts
+function validateManifest(manifest) {
+  if (!manifest.name) {
+    return { valid: false, error: "Manifest must have a 'name' field" };
+  }
+  if (!manifest.version) {
+    return { valid: false, error: "Manifest must have a 'version' field" };
   }
+  if (!/^[a-z][a-z0-9_-]*$/.test(manifest.name)) {
+    return {
+      valid: false,
+      error: "Name must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores"
+    };
+  }
+  if (!/^\d+\.\d+\.\d+/.test(manifest.version)) {
+    return {
+      valid: false,
+      error: "Version must be a valid semantic version (e.g., 1.0.0)"
+    };
+  }
+  return { valid: true };
 }
-var AGENT_INFO = {
-  "claude-code": {
-    displayName: "Claude Code",
-    skillsDir: ".claude/skills"
-  },
-  codex: {
-    displayName: "Codex",
-    skillsDir: ".codex/skills"
-  },
-  cursor: {
-    displayName: "Cursor",
-    skillsDir: ".cursor/skills"
-  },
-  gemini: {
-    displayName: "Gemini CLI",
-    skillsDir: ".gemini/skills"
-  },
-  kiro: {
-    displayName: "Kiro CLI",
-    skillsDir: ".kiro/skills"
-  },
-  opencode: {
-    displayName: "OpenCode",
-    skillsDir: ".opencode/skills"
+var DEFAULT_SKILL_FILES, PSPM_SCHEMA_URL;
+var init_manifest = __esm({
+  "src/lib/manifest.ts"() {
+    "use strict";
+    DEFAULT_SKILL_FILES = [
+      "SKILL.md",
+      "runtime",
+      "scripts",
+      "data"
+    ];
+    PSPM_SCHEMA_URL = "https://pspm.dev/schema/v1/pspm.json";
   }
-};
-var DEFAULT_AGENT_CONFIGS = {
-  "claude-code": { skillsDir: AGENT_INFO["claude-code"].skillsDir },
-  codex: { skillsDir: AGENT_INFO.codex.skillsDir },
-  cursor: { skillsDir: AGENT_INFO.cursor.skillsDir },
-  gemini: { skillsDir: AGENT_INFO.gemini.skillsDir },
-  kiro: { skillsDir: AGENT_INFO.kiro.skillsDir },
-  opencode: { skillsDir: AGENT_INFO.opencode.skillsDir }
-};
-var DEFAULT_AGENT = "claude-code";
-var ALL_AGENTS = [
-  "claude-code",
-  "codex",
-  "cursor",
-  "gemini",
-  "kiro",
-  "opencode"
-];
+});
+// src/lib/specifier.ts
+function parseSkillSpecifier(specifier) {
+  const match = specifier.match(SPECIFIER_PATTERN);
+  if (!match) {
+    return null;
+  }
+  return {
+    username: match[1],
+    name: match[2],
+    versionRange: match[3]
+  };
+}
+function parseGitHubSpecifier(specifier) {
+  const match = specifier.match(GITHUB_SPECIFIER_PATTERN);
+  if (!match) {
+    return null;
+  }
+  const [, owner, repo, pathWithSlash, ref] = match;
+  return {
+    owner,
+    repo,
+    // Remove leading slash from path
+    path: pathWithSlash ? pathWithSlash.slice(1) : void 0,
+    ref: ref || void 0
+  };
+}
+function formatGitHubSpecifier(spec) {
+  let result = `github:${spec.owner}/${spec.repo}`;
+  if (spec.path) {
+    result += `/${spec.path}`;
+  }
+  if (spec.ref) {
+    result += `@${spec.ref}`;
+  }
+  return result;
+}
+function getGitHubSkillName(spec) {
+  if (spec.path) {
+    const segments = spec.path.split("/").filter(Boolean);
+    return segments[segments.length - 1];
+  }
+  return spec.repo;
+}
+function isGitHubSpecifier(specifier) {
+  return specifier.startsWith("github:");
+}
+var SPECIFIER_PATTERN, GITHUB_SPECIFIER_PATTERN;
+var init_specifier = __esm({
+  "src/lib/specifier.ts"() {
+    "use strict";
+    SPECIFIER_PATTERN = /^@user\/([a-zA-Z0-9_-]+)\/([a-z][a-z0-9_-]*)(?:@(.+))?$/;
+    GITHUB_SPECIFIER_PATTERN = /^github:([a-zA-Z0-9_-]+)\/([a-zA-Z0-9_.-]+)(\/[^@]+)?(?:@(.+))?$/;
+  }
+});
+// src/lib/version.ts
+import * as semver from "semver";
+function resolveVersion(range, availableVersions) {
+  const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
+  if (!range || range === "latest" || range === "*") {
+    return sorted[0] ?? null;
+  }
+  return semver.maxSatisfying(sorted, range);
+}
+var init_version = __esm({
+  "src/lib/version.ts"() {
+    "use strict";
+  }
+});
+// src/lib/index.ts
+var init_lib = __esm({
+  "src/lib/index.ts"() {
+    "use strict";
+    init_integrity();
+    init_manifest();
+    init_specifier();
+    init_version();
+  }
+});
+// src/agents.ts
+import { checkbox } from "@inquirer/prompts";
 function resolveAgentConfig(name, overrides) {
   if (overrides?.[name]) {
     return overrides[name];
@@ -803,7 +739,7 @@ function resolveAgentConfig(name, overrides) {
 }
 function parseAgentArg(agentArg) {
   if (!agentArg) {
-    return [DEFAULT_AGENT];
+    return [...ALL_AGENTS];
   }
   if (agentArg === "none") {
     return ["none"];
@@ -831,35 +767,58 @@ async function promptForAgents() {
   }
   return selected;
 }
-var GitHubRateLimitError = class extends Error {
-  constructor() {
-    super(
-      "GitHub API rate limit exceeded. Set GITHUB_TOKEN environment variable for higher limits."
-    );
-    this.name = "GitHubRateLimitError";
-  }
-};
-var GitHubNotFoundError = class extends Error {
-  constructor(spec) {
-    const path = spec.path ? `/${spec.path}` : "";
-    const ref = spec.ref ? `@${spec.ref}` : "";
-    super(
-      `GitHub repository not found: ${spec.owner}/${spec.repo}${path}${ref}`
-    );
-    this.name = "GitHubNotFoundError";
-  }
-};
-var GitHubPathNotFoundError = class extends Error {
-  constructor(spec, availablePaths) {
-    const pathInfo = availablePaths?.length ? `
-Available paths in repository root:
-  ${availablePaths.join("\n  ")}` : "";
-    super(
-      `Path "${spec.path}" not found in ${spec.owner}/${spec.repo}${pathInfo}`
-    );
-    this.name = "GitHubPathNotFoundError";
+var AGENT_INFO, DEFAULT_AGENT_CONFIGS, ALL_AGENTS;
+var init_agents = __esm({
+  "src/agents.ts"() {
+    "use strict";
+    AGENT_INFO = {
+      "claude-code": {
+        displayName: "Claude Code",
+        skillsDir: ".claude/skills"
+      },
+      codex: {
+        displayName: "Codex",
+        skillsDir: ".codex/skills"
+      },
+      cursor: {
+        displayName: "Cursor",
+        skillsDir: ".cursor/skills"
+      },
+      gemini: {
+        displayName: "Gemini CLI",
+        skillsDir: ".gemini/skills"
+      },
+      kiro: {
+        displayName: "Kiro CLI",
+        skillsDir: ".kiro/skills"
+      },
+      opencode: {
+        displayName: "OpenCode",
+        skillsDir: ".opencode/skills"
+      }
+    };
+    DEFAULT_AGENT_CONFIGS = {
+      "claude-code": { skillsDir: AGENT_INFO["claude-code"].skillsDir },
+      codex: { skillsDir: AGENT_INFO.codex.skillsDir },
+      cursor: { skillsDir: AGENT_INFO.cursor.skillsDir },
+      gemini: { skillsDir: AGENT_INFO.gemini.skillsDir },
+      kiro: { skillsDir: AGENT_INFO.kiro.skillsDir },
+      opencode: { skillsDir: AGENT_INFO.opencode.skillsDir }
+    };
+    ALL_AGENTS = [
+      "claude-code",
+      "codex",
+      "cursor",
+      "gemini",
+      "kiro",
+      "opencode"
+    ];
   }
-};
+});
+// src/github.ts
+import { cp, lstat, mkdir as mkdir2, readdir, rm, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
 function getGitHubHeaders() {
   const headers = {
     Accept: "application/vnd.github+json",
@@ -874,7 +833,8 @@ function getGitHubHeaders() {
 }
 async function resolveGitHubRef(owner, repo, ref) {
   const headers = getGitHubHeaders();
-  if (!ref || ref === "latest") {
+  let resolvedRef = ref;
+  if (!resolvedRef || resolvedRef === "latest") {
     const repoUrl = `https://api.github.com/repos/${owner}/${repo}`;
     const repoResponse = await fetch(repoUrl, { headers });
     if (repoResponse.status === 404) {
@@ -890,9 +850,9 @@ async function resolveGitHubRef(owner, repo, ref) {
       throw new Error(`GitHub API error: ${repoResponse.status}`);
     }
     const repoData = await repoResponse.json();
-    ref = repoData.default_branch;
+    resolvedRef = repoData.default_branch;
   }
-  const commitUrl = `https://api.github.com/repos/${owner}/${repo}/commits/${ref}`;
+  const commitUrl = `https://api.github.com/repos/${owner}/${repo}/commits/${resolvedRef}`;
   const commitResponse = await fetch(commitUrl, { headers });
   if (commitResponse.status === 404) {
     throw new GitHubNotFoundError({ owner, repo, ref });
@@ -934,14 +894,14 @@ async function downloadGitHubPackage(spec) {
   return { buffer, commit, integrity };
 }
 async function extractGitHubPackage(spec, buffer, skillsDir) {
-  const destPath = spec.path ? join(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join(skillsDir, "_github", spec.owner, spec.repo);
-  const tempDir = join(skillsDir, "_github", ".temp", `${Date.now()}`);
-  await mkdir(tempDir, { recursive: true });
-  const tempFile = join(tempDir, "archive.tgz");
+  const destPath = spec.path ? join2(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join2(skillsDir, "_github", spec.owner, spec.repo);
+  const tempDir = join2(skillsDir, "_github", ".temp", `${Date.now()}`);
+  await mkdir2(tempDir, { recursive: true });
+  const tempFile = join2(tempDir, "archive.tgz");
   try {
-    await writeFile(tempFile, buffer);
-    const { exec: exec2 } = await import('child_process');
-    const { promisify: promisify2 } = await import('util');
+    await writeFile2(tempFile, buffer);
+    const { exec: exec2 } = await import("child_process");
+    const { promisify: promisify2 } = await import("util");
     const execAsync = promisify2(exec2);
     await execAsync(`tar -xzf "${tempFile}" -C "${tempDir}"`);
     const entries = await readdir(tempDir);
@@ -951,15 +911,15 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
     if (!extractedDir) {
       throw new Error("Failed to find extracted directory in tarball");
     }
-    const sourcePath = join(tempDir, extractedDir);
-    const copySource = spec.path ? join(sourcePath, spec.path) : sourcePath;
+    const sourcePath = join2(tempDir, extractedDir);
+    const copySource = spec.path ? join2(sourcePath, spec.path) : sourcePath;
     if (spec.path) {
       const pathExists = await lstat(copySource).catch(() => null);
       if (!pathExists) {
         const rootEntries = await readdir(sourcePath);
         const dirs = [];
         for (const entry of rootEntries) {
-          const stat7 = await lstat(join(sourcePath, entry)).catch(() => null);
+          const stat7 = await lstat(join2(sourcePath, entry)).catch(() => null);
           if (stat7?.isDirectory() && !entry.startsWith(".")) {
             dirs.push(entry);
           }
@@ -968,7 +928,7 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
       }
     }
     await rm(destPath, { recursive: true, force: true });
-    await mkdir(destPath, { recursive: true });
+    await mkdir2(destPath, { recursive: true });
     await cp(copySource, destPath, { recursive: true });
     return spec.path ? `.pspm/skills/_github/${spec.owner}/${spec.repo}/${spec.path}` : `.pspm/skills/_github/${spec.owner}/${spec.repo}`;
   } finally {
@@ -982,13 +942,54 @@ function getGitHubDisplayName(spec, commit) {
   }
   if (spec.ref || commit) {
     const ref = spec.ref || "HEAD";
-    name += ` (${ref}${""})`;
+    const shortCommit = commit ? commit.slice(0, 7) : "";
+    name += ` (${ref}${shortCommit ? `@${shortCommit}` : ""})`;
   }
   return name;
 }
+var GitHubRateLimitError, GitHubNotFoundError, GitHubPathNotFoundError;
+var init_github = __esm({
+  "src/github.ts"() {
+    "use strict";
+    init_lib();
+    GitHubRateLimitError = class extends Error {
+      constructor() {
+        super(
+          "GitHub API rate limit exceeded. Set GITHUB_TOKEN environment variable for higher limits."
+        );
+        this.name = "GitHubRateLimitError";
+      }
+    };
+    GitHubNotFoundError = class extends Error {
+      constructor(spec) {
+        const path = spec.path ? `/${spec.path}` : "";
+        const ref = spec.ref ? `@${spec.ref}` : "";
+        super(
+          `GitHub repository not found: ${spec.owner}/${spec.repo}${path}${ref}`
+        );
+        this.name = "GitHubNotFoundError";
+      }
+    };
+    GitHubPathNotFoundError = class extends Error {
+      constructor(spec, availablePaths) {
+        const pathInfo = availablePaths?.length ? `
+Available paths in repository root:
+  ${availablePaths.join("\n  ")}` : "";
+        super(
+          `Path "${spec.path}" not found in ${spec.owner}/${spec.repo}${pathInfo}`
+        );
+        this.name = "GitHubPathNotFoundError";
+      }
+    };
+  }
+});
+// src/lockfile.ts
+import { mkdir as mkdir3, readFile as readFile2, stat as stat2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname2 } from "path";
 async function hasLegacyLockfile() {
   try {
-    await stat(getLegacyLockfilePath());
+    await stat2(getLegacyLockfilePath());
     return true;
   } catch {
     return false;
@@ -998,26 +999,26 @@ async function migrateLockfileIfNeeded() {
   const legacyPath = getLegacyLockfilePath();
   const newPath = getLockfilePath();
   try {
-    await stat(legacyPath);
+    await stat2(legacyPath);
   } catch {
     return false;
   }
   try {
-    await stat(newPath);
+    await stat2(newPath);
     return false;
   } catch {
   }
   try {
-    const content = await readFile(legacyPath, "utf-8");
+    const content = await readFile2(legacyPath, "utf-8");
     const oldLockfile = JSON.parse(content);
     const newLockfile = {
       lockfileVersion: 2,
       registryUrl: oldLockfile.registryUrl,
       packages: oldLockfile.skills ?? {}
     };
-    await writeFile(newPath, `${JSON.stringify(newLockfile, null, 2)}
+    await writeFile3(newPath, `${JSON.stringify(newLockfile, null, 2)}
 `);
-    console.log(`Migrated lockfile: skill-lock.json \u2192 pspm-lock.json`);
+    console.log("Migrated lockfile: skill-lock.json \u2192 pspm-lock.json");
     return true;
   } catch {
     return false;
@@ -1026,7 +1027,7 @@ async function migrateLockfileIfNeeded() {
 async function readLockfile() {
   const lockfilePath = getLockfilePath();
   try {
-    const content = await readFile(lockfilePath, "utf-8");
+    const content = await readFile2(lockfilePath, "utf-8");
     const lockfile = JSON.parse(content);
     if (lockfile.lockfileVersion === 1 && lockfile.skills && !lockfile.packages) {
       return {
@@ -1039,7 +1040,7 @@ async function readLockfile() {
   } catch {
     if (await hasLegacyLockfile()) {
       try {
-        const content = await readFile(getLegacyLockfilePath(), "utf-8");
+        const content = await readFile2(getLegacyLockfilePath(), "utf-8");
         const legacyLockfile = JSON.parse(content);
         return {
           lockfileVersion: 2,
@@ -1055,7 +1056,7 @@ async function readLockfile() {
 }
 async function writeLockfile(lockfile) {
   const lockfilePath = getLockfilePath();
-  await mkdir(dirname(lockfilePath), { recursive: true });
+  await mkdir3(dirname2(lockfilePath), { recursive: true });
   const normalized = {
     lockfileVersion: 3,
     registryUrl: lockfile.registryUrl,
@@ -1064,7 +1065,7 @@ async function writeLockfile(lockfile) {
   if (lockfile.githubPackages && Object.keys(lockfile.githubPackages).length > 0) {
     normalized.githubPackages = lockfile.githubPackages;
   }
-  await writeFile(lockfilePath, `${JSON.stringify(normalized, null, 2)}
+  await writeFile3(lockfilePath, `${JSON.stringify(normalized, null, 2)}
 `);
 }
 async function createEmptyLockfile() {
@@ -1143,12 +1144,22 @@ async function listLockfileGitHubPackages() {
     entry
   }));
 }
+var init_lockfile = __esm({
+  "src/lockfile.ts"() {
+    "use strict";
+    init_config();
+  }
+});
+// src/manifest.ts
+import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import { join as join3 } from "path";
 function getManifestPath() {
-  return join(process.cwd(), "pspm.json");
+  return join3(process.cwd(), "pspm.json");
 }
 async function readManifest() {
   try {
-    const content = await readFile(getManifestPath(), "utf-8");
+    const content = await readFile3(getManifestPath(), "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -1156,7 +1167,7 @@ async function readManifest() {
 }
 async function writeManifest(manifest) {
   const content = JSON.stringify(manifest, null, 2);
-  await writeFile(getManifestPath(), `${content}
+  await writeFile4(getManifestPath(), `${content}
 `);
 }
 async function createMinimalManifest() {
@@ -1214,6 +1225,15 @@ async function removeGitHubDependency(specifier) {
   await writeManifest(manifest);
   return true;
 }
+var init_manifest2 = __esm({
+  "src/manifest.ts"() {
+    "use strict";
+  }
+});
+// src/symlinks.ts
+import { lstat as lstat2, mkdir as mkdir4, readlink, rm as rm2, symlink } from "fs/promises";
+import { dirname as dirname3, join as join4, relative } from "path";
 async function createAgentSymlinks(skills, options) {
   const { agents, projectRoot, agentConfigs } = options;
   if (agents.length === 1 && agents[0] === "none") {
@@ -1225,26 +1245,26 @@ async function createAgentSymlinks(skills, options) {
       console.warn(`Warning: Unknown agent "${agentName}", skipping symlinks`);
       continue;
     }
-    const agentSkillsDir = join(projectRoot, config2.skillsDir);
-    await mkdir(agentSkillsDir, { recursive: true });
+    const agentSkillsDir = join4(projectRoot, config2.skillsDir);
+    await mkdir4(agentSkillsDir, { recursive: true });
     for (const skill of skills) {
-      const symlinkPath = join(agentSkillsDir, skill.name);
-      const targetPath = join(projectRoot, skill.sourcePath);
-      const relativeTarget = relative(dirname(symlinkPath), targetPath);
+      const symlinkPath = join4(agentSkillsDir, skill.name);
+      const targetPath = join4(projectRoot, skill.sourcePath);
+      const relativeTarget = relative(dirname3(symlinkPath), targetPath);
       await createSymlink(symlinkPath, relativeTarget, skill.name);
     }
   }
 }
 async function createSymlink(symlinkPath, target, skillName) {
   try {
-    const stats = await lstat(symlinkPath).catch(() => null);
+    const stats = await lstat2(symlinkPath).catch(() => null);
     if (stats) {
       if (stats.isSymbolicLink()) {
         const existingTarget = await readlink(symlinkPath);
         if (existingTarget === target) {
           return;
         }
-        await rm(symlinkPath);
+        await rm2(symlinkPath);
       } else {
         console.warn(
           `Warning: File exists at symlink path for "${skillName}", skipping: ${symlinkPath}`
@@ -1270,11 +1290,11 @@ async function removeAgentSymlinks(skillName, options) {
     if (!config2) {
       continue;
     }
-    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join4(projectRoot, config2.skillsDir, skillName);
     try {
-      const stats = await lstat(symlinkPath).catch(() => null);
+      const stats = await lstat2(symlinkPath).catch(() => null);
       if (stats?.isSymbolicLink()) {
-        await rm(symlinkPath);
+        await rm2(symlinkPath);
       }
     } catch {
     }
@@ -1294,20 +1314,61 @@ async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
   for (const agentName of agents) {
     const config2 = resolveAgentConfig(agentName, agentConfigs);
     if (!config2) continue;
-    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join4(projectRoot, config2.skillsDir, skillName);
     try {
-      const stats = await lstat(symlinkPath);
+      const stats = await lstat2(symlinkPath);
       if (stats.isSymbolicLink()) {
         linkedAgents.push(agentName);
       }
     } catch {
     }
   }
-  return linkedAgents;
-}
-// src/commands/add.ts
-async function add(specifier, options) {
+  return linkedAgents;
+}
+var init_symlinks = __esm({
+  "src/symlinks.ts"() {
+    "use strict";
+    init_agents();
+  }
+});
+// src/commands/add.ts
+var add_exports = {};
+__export(add_exports, {
+  add: () => add
+});
+import { mkdir as mkdir5, rm as rm3 } from "fs/promises";
+import { join as join5 } from "path";
+async function add(specifiers, options) {
+  console.log("Resolving packages...\n");
+  const resolvedPackages = [];
+  const validationErrors = [];
+  for (const specifier of specifiers) {
+    try {
+      if (isGitHubSpecifier(specifier)) {
+        const resolved = await validateGitHubPackage(specifier);
+        resolvedPackages.push(resolved);
+      } else {
+        const resolved = await validateRegistryPackage(specifier);
+        resolvedPackages.push(resolved);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      validationErrors.push({ specifier, error: message });
+      console.error(`Failed to resolve ${specifier}: ${message}
+`);
+    }
+  }
+  if (resolvedPackages.length === 0) {
+    console.error("No packages could be resolved.");
+    process.exit(1);
+  }
+  if (validationErrors.length > 0) {
+    console.log(
+      `Resolved ${resolvedPackages.length} of ${specifiers.length} packages.
+`
+    );
+  }
   let agents;
   const manifest = await readManifest();
   if (options.agent) {
@@ -1319,216 +1380,359 @@ async function add(specifier, options) {
   } else {
     console.log("No pspm.json found. Let's set up your project.\n");
     agents = await promptForAgents();
+    console.log();
   }
-  if (isGitHubSpecifier(specifier)) {
-    await addGitHub(specifier, { ...options, resolvedAgents: agents });
-  } else {
-    await addRegistry(specifier, { ...options, resolvedAgents: agents });
+  const results = [];
+  for (const resolved of resolvedPackages) {
+    try {
+      if (resolved.type === "github") {
+        await installGitHubPackage(resolved, {
+          ...options,
+          resolvedAgents: agents
+        });
+      } else {
+        await installRegistryPackage(resolved, {
+          ...options,
+          resolvedAgents: agents
+        });
+      }
+      results.push({ specifier: resolved.specifier, success: true });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      results.push({
+        specifier: resolved.specifier,
+        success: false,
+        error: message
+      });
+      console.error(`Failed to install ${resolved.specifier}: ${message}
+`);
+    }
+  }
+  if (specifiers.length > 1) {
+    const succeeded = results.filter((r) => r.success).length;
+    const failed = results.filter((r) => !r.success).length + validationErrors.length;
+    console.log(`
+Summary: ${succeeded} added, ${failed} failed`);
+    if (failed > 0) {
+      process.exit(1);
+    }
   }
 }
-async function addRegistry(specifier, options) {
-  try {
-    const config2 = await resolveConfig();
-    const registryUrl = config2.registryUrl;
-    const apiKey = getTokenForRegistry(config2, registryUrl);
-    const parsed = parseSkillSpecifier(specifier);
-    if (!parsed) {
-      console.error(
-        `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}[@{version}]`
+async function validateRegistryPackage(specifier) {
+  const config2 = await resolveConfig();
+  const registryUrl = config2.registryUrl;
+  const apiKey = getTokenForRegistry(config2, registryUrl);
+  const parsed = parseSkillSpecifier(specifier);
+  if (!parsed) {
+    throw new Error(
+      `Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}[@{version}]`
+    );
+  }
+  const { username, name, versionRange } = parsed;
+  configure2({ registryUrl, apiKey: apiKey ?? "" });
+  console.log(`Resolving ${specifier}...`);
+  const versionsResponse = await listSkillVersions(username, name);
+  if (versionsResponse.status !== 200) {
+    if (versionsResponse.status === 401) {
+      if (!apiKey) {
+        throw new Error(
+          `Package @user/${username}/${name} requires authentication. Please run 'pspm login' to authenticate`
+        );
+      }
+      throw new Error(
+        `Access denied to @user/${username}/${name}. You may not have permission to access this private package.`
       );
+    }
+    const errorMessage = extractApiErrorMessage(
+      versionsResponse,
+      `Skill @user/${username}/${name} not found`
+    );
+    throw new Error(errorMessage);
+  }
+  const versions = versionsResponse.data;
+  if (versions.length === 0) {
+    throw new Error(`Skill @user/${username}/${name} not found`);
+  }
+  const versionStrings = versions.map((v) => v.version);
+  const resolvedVersion = resolveVersion(versionRange || "*", versionStrings);
+  if (!resolvedVersion) {
+    throw new Error(
+      `No version matching "${versionRange || "latest"}" found for @user/${username}/${name}. Available versions: ${versionStrings.join(", ")}`
+    );
+  }
+  const versionResponse = await getSkillVersion(
+    username,
+    name,
+    resolvedVersion
+  );
+  if (versionResponse.status !== 200 || !versionResponse.data) {
+    const errorMessage = extractApiErrorMessage(
+      versionResponse,
+      `Version ${resolvedVersion} not found`
+    );
+    throw new Error(errorMessage);
+  }
+  console.log(`Resolved @user/${username}/${name}@${resolvedVersion}`);
+  return {
+    type: "registry",
+    specifier,
+    username,
+    name,
+    versionRange,
+    resolvedVersion,
+    versionInfo: {
+      downloadUrl: versionResponse.data.downloadUrl,
+      checksum: versionResponse.data.checksum
+    }
+  };
+}
+async function validateGitHubPackage(specifier) {
+  const parsed = parseGitHubSpecifier(specifier);
+  if (!parsed) {
+    throw new Error(
+      `Invalid GitHub specifier "${specifier}". Use format: github:{owner}/{repo}[/{path}][@{ref}]`
+    );
+  }
+  const ref = parsed.ref || "HEAD";
+  console.log(`Resolving ${getGitHubDisplayName(parsed)}...`);
+  const result = await downloadGitHubPackage(parsed);
+  console.log(`Resolved ${specifier} (${ref}@${result.commit.slice(0, 7)})`);
+  return {
+    type: "github",
+    specifier,
+    parsed,
+    ref,
+    downloadResult: result
+  };
+}
+async function installRegistryPackage(resolved, options) {
+  const { username, name, versionRange, resolvedVersion, versionInfo } = resolved;
+  console.log(`Installing @user/${username}/${name}@${resolvedVersion}...`);
+  const config2 = await resolveConfig();
+  const apiKey = getTokenForRegistry(config2, config2.registryUrl);
+  const isPresignedUrl = versionInfo.downloadUrl.includes(".r2.cloudflarestorage.com") || versionInfo.downloadUrl.includes("X-Amz-Signature");
+  const downloadHeaders = {};
+  if (!isPresignedUrl && apiKey) {
+    downloadHeaders.Authorization = `Bearer ${apiKey}`;
+  }
+  const tarballResponse = await fetch(versionInfo.downloadUrl, {
+    headers: downloadHeaders,
+    redirect: "follow"
+  });
+  if (!tarballResponse.ok) {
+    throw new Error(`Failed to download tarball (${tarballResponse.status})`);
+  }
+  const tarballBuffer = Buffer.from(await tarballResponse.arrayBuffer());
+  const integrity = calculateIntegrity(tarballBuffer);
+  const expectedIntegrity = `sha256-${Buffer.from(versionInfo.checksum, "hex").toString("base64")}`;
+  if (integrity !== expectedIntegrity) {
+    throw new Error("Checksum verification failed");
+  }
+  const skillsDir = getSkillsDir();
+  const destDir = join5(skillsDir, username, name);
+  await mkdir5(destDir, { recursive: true });
+  const { writeFile: writeFile8 } = await import("fs/promises");
+  const tempFile = join5(destDir, ".temp.tgz");
+  await writeFile8(tempFile, tarballBuffer);
+  const { exec: exec2 } = await import("child_process");
+  const { promisify: promisify2 } = await import("util");
+  const execAsync = promisify2(exec2);
+  try {
+    await rm3(destDir, { recursive: true, force: true });
+    await mkdir5(destDir, { recursive: true });
+    await writeFile8(tempFile, tarballBuffer);
+    await execAsync(
+      `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
+    );
+  } finally {
+    await rm3(tempFile, { force: true });
+  }
+  const fullName = `@user/${username}/${name}`;
+  await addToLockfile(fullName, {
+    version: resolvedVersion,
+    resolved: versionInfo.downloadUrl,
+    integrity
+  });
+  const dependencyRange = versionRange || `^${resolvedVersion}`;
+  await addDependency(fullName, dependencyRange);
+  const agents = options.resolvedAgents;
+  if (agents[0] !== "none") {
+    const skillManifest = await readManifest();
+    const skillInfo = {
+      name,
+      sourcePath: getRegistrySkillPath(username, name)
+    };
+    await createAgentSymlinks([skillInfo], {
+      agents,
+      projectRoot: process.cwd(),
+      agentConfigs: skillManifest?.agents
+    });
+  }
+  console.log(`Installed @user/${username}/${name}@${resolvedVersion}`);
+  console.log(`Location: ${destDir}`);
+}
+async function installGitHubPackage(resolved, options) {
+  const { specifier, parsed, ref, downloadResult } = resolved;
+  console.log(
+    `Installing ${specifier} (${ref}@${downloadResult.commit.slice(0, 7)})...`
+  );
+  const skillsDir = getSkillsDir();
+  const destPath = await extractGitHubPackage(
+    parsed,
+    downloadResult.buffer,
+    skillsDir
+  );
+  const lockfileSpecifier = formatGitHubSpecifier({
+    owner: parsed.owner,
+    repo: parsed.repo,
+    path: parsed.path
+    // Don't include ref in the specifier key, it's stored in gitRef
+  });
+  const entry = {
+    version: downloadResult.commit.slice(0, 7),
+    resolved: `https://github.com/${parsed.owner}/${parsed.repo}`,
+    integrity: downloadResult.integrity,
+    gitCommit: downloadResult.commit,
+    gitRef: ref
+  };
+  await addGitHubToLockfile(lockfileSpecifier, entry);
+  await addGitHubDependency(lockfileSpecifier, ref);
+  const agents = options.resolvedAgents;
+  if (agents[0] !== "none") {
+    const manifest = await readManifest();
+    const skillName = getGitHubSkillName(parsed);
+    const skillInfo = {
+      name: skillName,
+      sourcePath: getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path)
+    };
+    await createAgentSymlinks([skillInfo], {
+      agents,
+      projectRoot: process.cwd(),
+      agentConfigs: manifest?.agents
+    });
+  }
+  console.log(
+    `Installed ${specifier} (${ref}@${downloadResult.commit.slice(0, 7)})`
+  );
+  console.log(`Location: ${destPath}`);
+}
+var init_add = __esm({
+  "src/commands/add.ts"() {
+    "use strict";
+    init_agents();
+    init_api_client();
+    init_config();
+    init_errors();
+    init_github();
+    init_lib();
+    init_lockfile();
+    init_manifest2();
+    init_symlinks();
+  }
+});
+// src/index.ts
+import { readFileSync } from "fs";
+import { dirname as dirname4, join as join12 } from "path";
+import { fileURLToPath } from "url";
+import { Command } from "commander";
+// src/commands/access.ts
+init_api_client();
+init_config();
+init_lib();
+async function access(specifier, options) {
+  try {
+    const apiKey = await requireApiKey();
+    const registryUrl = await getRegistryUrl();
+    if (options.public && options.private) {
+      console.error("Error: Cannot specify both --public and --private");
       process.exit(1);
     }
-    const { username, name, versionRange } = parsed;
-    configure2({ registryUrl, apiKey: apiKey ?? "" });
-    console.log(`Resolving ${specifier}...`);
-    const versionsResponse = await listSkillVersions(username, name);
-    if (versionsResponse.status !== 200) {
-      if (versionsResponse.status === 401) {
-        if (!apiKey) {
+    if (!options.public && !options.private) {
+      console.error("Error: Must specify either --public or --private");
+      process.exit(1);
+    }
+    const visibility = options.public ? "public" : "private";
+    let packageName;
+    if (specifier) {
+      const parsed = parseSkillSpecifier(specifier);
+      if (!parsed) {
+        console.error(
+          `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}`
+        );
+        process.exit(1);
+      }
+      packageName = parsed.name;
+    } else {
+      const { readFile: readFile7 } = await import("fs/promises");
+      const { join: join13 } = await import("path");
+      let manifest = null;
+      try {
+        const content = await readFile7(
+          join13(process.cwd(), "pspm.json"),
+          "utf-8"
+        );
+        manifest = JSON.parse(content);
+      } catch {
+        try {
+          const content = await readFile7(
+            join13(process.cwd(), "package.json"),
+            "utf-8"
+          );
+          manifest = JSON.parse(content);
+        } catch {
           console.error(
-            `Error: Package @user/${username}/${name} requires authentication`
+            "Error: No pspm.json or package.json found in current directory"
           );
-          console.error("Please run 'pspm login' to authenticate");
-        } else {
           console.error(
-            `Error: Access denied to @user/${username}/${name}. You may not have permission to access this private package.`
+            "Either run this command in a package directory or specify a package name"
           );
+          process.exit(1);
         }
+      }
+      if (!manifest?.name) {
+        console.error("Error: Package manifest is missing 'name' field");
         process.exit(1);
       }
-      const errorMessage = extractApiErrorMessage(
-        versionsResponse,
-        `Skill @user/${username}/${name} not found`
-      );
-      console.error(`Error: ${errorMessage}`);
-      process.exit(1);
-    }
-    const versions = versionsResponse.data;
-    if (versions.length === 0) {
-      console.error(`Error: Skill @user/${username}/${name} not found`);
-      process.exit(1);
-    }
-    const versionStrings = versions.map((v) => v.version);
-    const resolved = resolveVersion(versionRange || "*", versionStrings);
-    if (!resolved) {
-      console.error(
-        `Error: No version matching "${versionRange || "latest"}" found for @user/${username}/${name}`
-      );
-      console.error(`Available versions: ${versionStrings.join(", ")}`);
-      process.exit(1);
+      packageName = manifest.name;
     }
-    console.log(`Installing @user/${username}/${name}@${resolved}...`);
-    const versionResponse = await getSkillVersion(username, name, resolved);
-    if (versionResponse.status !== 200 || !versionResponse.data) {
-      const errorMessage = extractApiErrorMessage(
-        versionResponse,
-        `Version ${resolved} not found`
-      );
+    configure2({ registryUrl, apiKey });
+    console.log(`Setting ${packageName} to ${visibility}...`);
+    const response = await changeSkillAccess(packageName, { visibility });
+    if (response.status !== 200 || !response.data) {
+      const errorMessage = response.error ?? "Failed to change visibility";
       console.error(`Error: ${errorMessage}`);
       process.exit(1);
     }
-    const versionInfo = versionResponse.data;
-    const isPresignedUrl = versionInfo.downloadUrl.includes(".r2.cloudflarestorage.com") || versionInfo.downloadUrl.includes("X-Amz-Signature");
-    const downloadHeaders = {};
-    if (!isPresignedUrl && apiKey) {
-      downloadHeaders.Authorization = `Bearer ${apiKey}`;
-    }
-    const tarballResponse = await fetch(versionInfo.downloadUrl, {
-      headers: downloadHeaders,
-      redirect: "follow"
-    });
-    if (!tarballResponse.ok) {
-      console.error(
-        `Error: Failed to download tarball (${tarballResponse.status})`
-      );
-      process.exit(1);
-    }
-    const tarballBuffer = Buffer.from(await tarballResponse.arrayBuffer());
-    const integrity = calculateIntegrity(tarballBuffer);
-    const expectedIntegrity = `sha256-${Buffer.from(versionInfo.checksum, "hex").toString("base64")}`;
-    if (integrity !== expectedIntegrity) {
-      console.error("Error: Checksum verification failed");
-      process.exit(1);
-    }
-    const skillsDir = getSkillsDir();
-    const destDir = join(skillsDir, username, name);
-    await mkdir(destDir, { recursive: true });
-    const { writeFile: writeFile8 } = await import('fs/promises');
-    const tempFile = join(destDir, ".temp.tgz");
-    await writeFile8(tempFile, tarballBuffer);
-    const { exec: exec2 } = await import('child_process');
-    const { promisify: promisify2 } = await import('util');
-    const execAsync = promisify2(exec2);
-    try {
-      await rm(destDir, { recursive: true, force: true });
-      await mkdir(destDir, { recursive: true });
-      await writeFile8(tempFile, tarballBuffer);
-      await execAsync(
-        `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
+    const result = response.data;
+    console.log(
+      `+ @user/${result.username}/${result.name} is now ${result.visibility}`
+    );
+    if (visibility === "public") {
+      console.log("");
+      console.log(
+        "Note: This action is irreversible. Public packages cannot be made private."
       );
-    } finally {
-      await rm(tempFile, { force: true });
-    }
-    const fullName = `@user/${username}/${name}`;
-    await addToLockfile(fullName, {
-      version: resolved,
-      resolved: versionInfo.downloadUrl,
-      integrity
-    });
-    const dependencyRange = versionRange || `^${resolved}`;
-    await addDependency(fullName, dependencyRange);
-    const agents = options.resolvedAgents;
-    if (agents[0] !== "none") {
-      const skillManifest = await readManifest();
-      const skillInfo = {
-        name,
-        sourcePath: getRegistrySkillPath(username, name)
-      };
-      await createAgentSymlinks([skillInfo], {
-        agents,
-        projectRoot: process.cwd(),
-        agentConfigs: skillManifest?.agents
-      });
     }
-    console.log(`Installed @user/${username}/${name}@${resolved}`);
-    console.log(`Location: ${destDir}`);
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     console.error(`Error: ${message}`);
     process.exit(1);
   }
 }
-async function addGitHub(specifier, options) {
-  try {
-    const parsed = parseGitHubSpecifier(specifier);
-    if (!parsed) {
-      console.error(
-        `Error: Invalid GitHub specifier "${specifier}". Use format: github:{owner}/{repo}[/{path}][@{ref}]`
-      );
-      process.exit(1);
-    }
-    const ref = parsed.ref || "HEAD";
-    console.log(`Resolving ${getGitHubDisplayName(parsed)}...`);
-    const result = await downloadGitHubPackage(parsed);
-    console.log(
-      `Installing ${specifier} (${ref}@${result.commit.slice(0, 7)})...`
-    );
-    const skillsDir = getSkillsDir();
-    const destPath = await extractGitHubPackage(
-      parsed,
-      result.buffer,
-      skillsDir
-    );
-    const lockfileSpecifier = formatGitHubSpecifier({
-      owner: parsed.owner,
-      repo: parsed.repo,
-      path: parsed.path
-      // Don't include ref in the specifier key, it's stored in gitRef
-    });
-    const entry = {
-      version: result.commit.slice(0, 7),
-      resolved: `https://github.com/${parsed.owner}/${parsed.repo}`,
-      integrity: result.integrity,
-      gitCommit: result.commit,
-      gitRef: ref
-    };
-    await addGitHubToLockfile(lockfileSpecifier, entry);
-    await addGitHubDependency(lockfileSpecifier, ref);
-    const agents = options.resolvedAgents;
-    if (agents[0] !== "none") {
-      const manifest = await readManifest();
-      const skillName = getGitHubSkillName(parsed);
-      const skillInfo = {
-        name: skillName,
-        sourcePath: getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path)
-      };
-      await createAgentSymlinks([skillInfo], {
-        agents,
-        projectRoot: process.cwd(),
-        agentConfigs: manifest?.agents
-      });
-    }
-    console.log(`Installed ${specifier} (${ref}@${result.commit.slice(0, 7)})`);
-    console.log(`Location: ${destPath}`);
-  } catch (error) {
-    if (error instanceof GitHubRateLimitError) {
-      console.error(`Error: ${error.message}`);
-    } else if (error instanceof GitHubPathNotFoundError) {
-      console.error(`Error: ${error.message}`);
-    } else if (error instanceof GitHubNotFoundError) {
-      console.error(`Error: ${error.message}`);
-    } else {
-      const message = error instanceof Error ? error.message : "Unknown error";
-      console.error(`Error: ${message}`);
-    }
-    process.exit(1);
-  }
-}
+// src/commands/index.ts
+init_add();
+// src/commands/config/init.ts
+import { stat as stat3, writeFile as writeFile5 } from "fs/promises";
+import { join as join6 } from "path";
 async function configInit(options) {
   try {
-    const configPath = join(process.cwd(), ".pspmrc");
+    const configPath = join6(process.cwd(), ".pspmrc");
     try {
-      await stat(configPath);
+      await stat3(configPath);
       console.error("Error: .pspmrc already exists in this directory.");
       process.exit(1);
     } catch {
@@ -1541,7 +1745,7 @@ async function configInit(options) {
       lines.push("; registry = https://custom-registry.example.com");
     }
     lines.push("");
-    await writeFile(configPath, lines.join("\n"));
+    await writeFile5(configPath, lines.join("\n"));
     console.log("Created .pspmrc");
     console.log("");
     console.log("Contents:");
@@ -1556,6 +1760,7 @@ async function configInit(options) {
 }
 // src/commands/config/show.ts
+init_config();
 async function configShow() {
   try {
     const resolved = await resolveConfig();
@@ -1585,6 +1790,9 @@ async function configShow() {
 }
 // src/commands/deprecate.ts
+init_api_client();
+init_config();
+init_lib();
 async function deprecate(specifier, message, options) {
   try {
     const apiKey = await requireApiKey();
@@ -1647,6 +1855,12 @@ async function deprecate(specifier, message, options) {
     process.exit(1);
   }
 }
+// src/commands/init.ts
+init_lib();
+import { readFile as readFile4, stat as stat4, writeFile as writeFile6 } from "fs/promises";
+import { basename, join as join7 } from "path";
+import { createInterface } from "readline";
 function prompt(rl, question, defaultValue) {
   return new Promise((resolve) => {
     const displayDefault = defaultValue ? ` (${defaultValue})` : "";
@@ -1657,8 +1871,8 @@ function prompt(rl, question, defaultValue) {
 }
 async function readExistingPackageJson() {
   try {
-    const content = await readFile(
-      join(process.cwd(), "package.json"),
+    const content = await readFile4(
+      join7(process.cwd(), "package.json"),
       "utf-8"
     );
     const pkg = JSON.parse(content);
@@ -1675,8 +1889,8 @@ async function readExistingPackageJson() {
 }
 async function getGitAuthor() {
   try {
-    const { exec: exec2 } = await import('child_process');
-    const { promisify: promisify2 } = await import('util');
+    const { exec: exec2 } = await import("child_process");
+    const { promisify: promisify2 } = await import("util");
     const execAsync = promisify2(exec2);
     const [nameResult, emailResult] = await Promise.all([
       execAsync("git config user.name").catch(() => ({ stdout: "" })),
@@ -1707,10 +1921,10 @@ function isValidVersion(version2) {
 }
 async function init(options) {
   try {
-    const pspmJsonPath = join(process.cwd(), "pspm.json");
+    const pspmJsonPath = join7(process.cwd(), "pspm.json");
     let exists = false;
     try {
-      await stat(pspmJsonPath);
+      await stat4(pspmJsonPath);
       exists = true;
     } catch {
     }
@@ -1821,9 +2035,9 @@ async function init(options) {
         throw error;
       }
     }
-    if (!manifest.description) delete manifest.description;
-    if (!manifest.author) delete manifest.author;
-    if (manifest.capabilities?.length === 0) delete manifest.capabilities;
+    if (!manifest.description) manifest.description = void 0;
+    if (!manifest.author) manifest.author = void 0;
+    if (manifest.capabilities?.length === 0) manifest.capabilities = void 0;
     const content = JSON.stringify(manifest, null, 2);
     console.log("");
     console.log(`About to write to ${pspmJsonPath}:`);
@@ -1842,10 +2056,10 @@ async function init(options) {
         process.exit(0);
       }
     }
-    await writeFile(pspmJsonPath, `${content}
+    await writeFile6(pspmJsonPath, `${content}
 `);
     try {
-      await stat(join(process.cwd(), "SKILL.md"));
+      await stat4(join7(process.cwd(), "SKILL.md"));
     } catch {
       console.log(
         "Note: Create a SKILL.md file with your skill's prompt content."
@@ -1862,6 +2076,20 @@ async function init(options) {
     process.exit(1);
   }
 }
+// src/commands/install.ts
+init_agents();
+init_api_client();
+init_config();
+init_errors();
+init_github();
+init_lib();
+init_lockfile();
+init_manifest2();
+init_symlinks();
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir6, readFile as readFile5, rm as rm4, writeFile as writeFile7 } from "fs/promises";
+import { join as join8 } from "path";
 function getCacheFilePath(cacheDir, integrity) {
   const match = integrity.match(/^sha256-(.+)$/);
   if (!match) {
@@ -1869,15 +2097,15 @@ function getCacheFilePath(cacheDir, integrity) {
   }
   const base64Hash = match[1];
   const hexHash = Buffer.from(base64Hash, "base64").toString("hex");
-  return join(cacheDir, `sha256-${hexHash}.tgz`);
+  return join8(cacheDir, `sha256-${hexHash}.tgz`);
 }
 async function readFromCache(cacheDir, integrity) {
   try {
     const cachePath = getCacheFilePath(cacheDir, integrity);
-    const data = await readFile(cachePath);
-    const actualIntegrity = `sha256-${createHash("sha256").update(data).digest("base64")}`;
+    const data = await readFile5(cachePath);
+    const actualIntegrity = `sha256-${createHash2("sha256").update(data).digest("base64")}`;
     if (actualIntegrity !== integrity) {
-      await rm(cachePath, { force: true });
+      await rm4(cachePath, { force: true });
       return null;
     }
     return data;
@@ -1887,32 +2115,31 @@ async function readFromCache(cacheDir, integrity) {
 }
 async function writeToCache(cacheDir, integrity, data) {
   try {
-    await mkdir(cacheDir, { recursive: true });
+    await mkdir6(cacheDir, { recursive: true });
     const cachePath = getCacheFilePath(cacheDir, integrity);
-    await writeFile(cachePath, data);
+    await writeFile7(cachePath, data);
   } catch {
   }
 }
-async function install(options) {
+async function install(specifiers, options) {
+  if (specifiers.length > 0) {
+    const { add: add2 } = await Promise.resolve().then(() => (init_add(), add_exports));
+    await add2(specifiers, {
+      save: true,
+      agent: options.agent,
+      yes: options.yes
+    });
+    return;
+  }
+  await installFromLockfile(options);
+}
+async function installFromLockfile(options) {
   try {
     const config2 = await resolveConfig();
     const registryUrl = config2.registryUrl;
     const apiKey = getTokenForRegistry(config2, registryUrl);
     const skillsDir = options.dir || getSkillsDir();
     const cacheDir = getCacheDir();
-    const manifest = await readManifest();
-    const agentConfigs = manifest?.agents;
-    let agents;
-    if (options.agent) {
-      agents = parseAgentArg(options.agent);
-    } else if (manifest) {
-      agents = parseAgentArg(void 0);
-    } else if (options.yes) {
-      agents = parseAgentArg(void 0);
-    } else {
-      console.log("No pspm.json found. Let's set up your project.\n");
-      agents = await promptForAgents();
-    }
     await migrateLockfileIfNeeded();
     let lockfile = await readLockfile();
     const manifestDeps = await getDependencies();
@@ -2069,6 +2296,20 @@ Resolving ${missingGitHubDeps.length} GitHub dependency(ies)...
       }
       lockfile = await readLockfile();
     }
+    const manifest = await readManifest();
+    const agentConfigs = manifest?.agents;
+    let agents;
+    if (options.agent) {
+      agents = parseAgentArg(options.agent);
+    } else if (manifest) {
+      agents = parseAgentArg(void 0);
+    } else if (options.yes) {
+      agents = parseAgentArg(void 0);
+    } else {
+      console.log("\nNo pspm.json found. Let's set up your project.\n");
+      agents = await promptForAgents();
+      console.log();
+    }
     const packages = lockfile?.packages ?? lockfile?.skills ?? {};
     const packageCount = Object.keys(packages).length;
     if (packageCount > 0) {
@@ -2119,7 +2360,7 @@ Installing ${packageCount} registry skill(s)...
             continue;
           }
           tarballBuffer = Buffer.from(await response.arrayBuffer());
-          const actualIntegrity = `sha256-${createHash("sha256").update(tarballBuffer).digest("base64")}`;
+          const actualIntegrity = `sha256-${createHash2("sha256").update(tarballBuffer).digest("base64")}`;
           if (actualIntegrity !== entry.integrity) {
             console.error(
               `  Error: Checksum verification failed for ${fullName}`
@@ -2131,20 +2372,20 @@ Installing ${packageCount} registry skill(s)...
           }
           await writeToCache(cacheDir, entry.integrity, tarballBuffer);
         }
-        const destDir = join(skillsDir, username, name);
-        await rm(destDir, { recursive: true, force: true });
-        await mkdir(destDir, { recursive: true });
-        const tempFile = join(destDir, ".temp.tgz");
-        await writeFile(tempFile, tarballBuffer);
-        const { exec: exec2 } = await import('child_process');
-        const { promisify: promisify2 } = await import('util');
+        const destDir = join8(skillsDir, username, name);
+        await rm4(destDir, { recursive: true, force: true });
+        await mkdir6(destDir, { recursive: true });
+        const tempFile = join8(destDir, ".temp.tgz");
+        await writeFile7(tempFile, tarballBuffer);
+        const { exec: exec2 } = await import("child_process");
+        const { promisify: promisify2 } = await import("util");
         const execAsync = promisify2(exec2);
         try {
           await execAsync(
             `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
           );
         } finally {
-          await rm(tempFile, { force: true });
+          await rm4(tempFile, { force: true });
         }
         console.log(
           `  Installed to ${destDir}${fromCache ? " (from cache)" : ""}`
@@ -2257,6 +2498,11 @@ All ${totalCount} skill(s) installed.`);
 }
 // src/commands/link.ts
+init_agents();
+init_lib();
+init_lockfile();
+init_manifest2();
+init_symlinks();
 async function link(options) {
   try {
     const manifest = await readManifest();
@@ -2327,6 +2573,15 @@ async function link(options) {
     process.exit(1);
   }
 }
+// src/commands/list.ts
+init_agents();
+init_lib();
+init_lockfile();
+init_manifest2();
+init_symlinks();
+import { access as access2 } from "fs/promises";
+import { join as join9 } from "path";
 async function list(options) {
   try {
     const registrySkills = await listLockfileSkills();
@@ -2341,10 +2596,10 @@ async function list(options) {
       if (!match) continue;
       const [, username, skillName] = match;
       const sourcePath = getRegistrySkillPath(username, skillName);
-      const absolutePath = join(projectRoot, sourcePath);
+      const absolutePath = join9(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access$1(absolutePath);
+        await access2(absolutePath);
       } catch {
         status = "missing";
       }
@@ -2374,10 +2629,10 @@ async function list(options) {
         parsed.repo,
         parsed.path
       );
-      const absolutePath = join(projectRoot, sourcePath);
+      const absolutePath = join9(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access$1(absolutePath);
+        await access2(absolutePath);
       } catch {
         status = "missing";
       }
@@ -2440,13 +2695,21 @@ Total: ${skills.length} skill(s) (${parts.join(", ")})`);
     process.exit(1);
   }
 }
+// src/commands/login.ts
+init_api_client();
+init_config();
+import { randomBytes } from "crypto";
+import http from "http";
+import { URL as URL2 } from "url";
+import open from "open";
 var DEFAULT_WEB_APP_URL = "https://pspm.dev";
 function getWebAppUrl(registryUrl) {
   if (process.env.PSPM_WEB_URL) {
     return process.env.PSPM_WEB_URL.replace(/\/$/, "");
   }
   try {
-    const url = new URL$1(registryUrl);
+    const url = new URL2(registryUrl);
     return `${url.protocol}//${url.host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
@@ -2454,7 +2717,7 @@ function getWebAppUrl(registryUrl) {
 }
 function getServerUrl(registryUrl) {
   try {
-    const url = new URL$1(registryUrl);
+    const url = new URL2(registryUrl);
     return `${url.protocol}//${url.host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
@@ -2486,7 +2749,7 @@ function startCallbackServer(expectedState) {
       rejectToken = reject;
     });
     const server = http.createServer((req, res) => {
-      const url = new URL$1(req.url || "/", `http://localhost`);
+      const url = new URL2(req.url || "/", "http://localhost");
       if (url.pathname === "/callback") {
         const token = url.searchParams.get("token");
         const state = url.searchParams.get("state");
@@ -2573,7 +2836,7 @@ async function browserLogin() {
   console.log("Starting browser-based login...");
   const { port, tokenPromise, cleanup } = await startCallbackServer(state);
   const loginUrl = `${webAppUrl}/cli/login?port=${port}&state=${encodeURIComponent(state)}`;
-  console.log(`Opening browser to authenticate...`);
+  console.log("Opening browser to authenticate...");
   console.log(`If the browser doesn't open, visit: ${loginUrl}`);
   try {
     await open(loginUrl);
@@ -2617,6 +2880,7 @@ async function login(options) {
 }
 // src/commands/logout.ts
+init_config();
 async function logout() {
   try {
     const loggedIn = await isLoggedIn();
@@ -2632,6 +2896,11 @@ async function logout() {
     process.exit(1);
   }
 }
+// src/commands/migrate.ts
+init_config();
+init_lockfile();
+import { mkdir as mkdir7, readdir as readdir2, rename, rm as rm5, stat as stat5 } from "fs/promises";
 async function migrate(options) {
   try {
     const legacySkillsDir = getLegacySkillsDir();
@@ -2642,26 +2911,26 @@ async function migrate(options) {
     let migrationNeeded = false;
     const actions = [];
     try {
-      const legacyStats = await stat(legacySkillsDir);
+      const legacyStats = await stat5(legacySkillsDir);
       if (legacyStats.isDirectory()) {
-        const contents = await readdir(legacySkillsDir);
+        const contents = await readdir2(legacySkillsDir);
         if (contents.length > 0) {
           migrationNeeded = true;
-          actions.push(`Move .skills/ \u2192 .pspm/skills/`);
+          actions.push("Move .skills/ \u2192 .pspm/skills/");
         }
       }
     } catch {
     }
     try {
-      await stat(legacyLockfilePath);
+      await stat5(legacyLockfilePath);
       try {
-        await stat(newLockfilePath);
+        await stat5(newLockfilePath);
         actions.push(
-          `Note: Both skill-lock.json and pspm-lock.json exist. Manual merge may be needed.`
+          "Note: Both skill-lock.json and pspm-lock.json exist. Manual merge may be needed."
         );
       } catch {
         migrationNeeded = true;
-        actions.push(`Migrate skill-lock.json \u2192 pspm-lock.json`);
+        actions.push("Migrate skill-lock.json \u2192 pspm-lock.json");
       }
     } catch {
     }
@@ -2687,21 +2956,21 @@ async function migrate(options) {
       console.log("  \u2713 Migrated skill-lock.json \u2192 pspm-lock.json");
     }
     try {
-      const legacyStats = await stat(legacySkillsDir);
+      const legacyStats = await stat5(legacySkillsDir);
       if (legacyStats.isDirectory()) {
-        const contents = await readdir(legacySkillsDir);
+        const contents = await readdir2(legacySkillsDir);
         if (contents.length > 0) {
-          await mkdir(pspmDir, { recursive: true });
+          await mkdir7(pspmDir, { recursive: true });
           try {
-            const newStats = await stat(newSkillsDir);
+            const newStats = await stat5(newSkillsDir);
             if (newStats.isDirectory()) {
-              const newContents = await readdir(newSkillsDir);
+              const newContents = await readdir2(newSkillsDir);
               if (newContents.length > 0) {
                 console.log(
                   "  ! Both .skills/ and .pspm/skills/ have content. Manual merge required."
                 );
               } else {
-                await rm(newSkillsDir, { recursive: true, force: true });
+                await rm5(newSkillsDir, { recursive: true, force: true });
                 await rename(legacySkillsDir, newSkillsDir);
                 console.log("  \u2713 Moved .skills/ \u2192 .pspm/skills/");
               }
@@ -2731,19 +3000,30 @@ async function migrate(options) {
     process.exit(1);
   }
 }
-var exec = promisify(exec$1);
+// src/commands/publish.ts
+init_api_client();
+init_config();
+init_errors();
+init_lib();
+import { exec as execCb } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { readdir as readdir3, readFile as readFile6, stat as stat6 } from "fs/promises";
+import { join as join10, relative as relative2 } from "path";
+import { promisify } from "util";
+var exec = promisify(execCb);
 async function detectManifest() {
   const cwd = process.cwd();
-  const pspmJsonPath = join(cwd, "pspm.json");
+  const pspmJsonPath = join10(cwd, "pspm.json");
   try {
-    const content = await readFile(pspmJsonPath, "utf-8");
+    const content = await readFile6(pspmJsonPath, "utf-8");
     const manifest = JSON.parse(content);
     return { type: "pspm.json", manifest, path: pspmJsonPath };
   } catch {
   }
-  const packageJsonPath = join(cwd, "package.json");
+  const packageJsonPath = join10(cwd, "package.json");
   try {
-    const content = await readFile(packageJsonPath, "utf-8");
+    const content = await readFile6(packageJsonPath, "utf-8");
     const packageJson2 = JSON.parse(content);
     const manifest = {
       name: packageJson2.name,
@@ -2766,10 +3046,10 @@ function formatBytes(bytes) {
 async function getFilesWithSizes(dir, baseDir) {
   const results = [];
   try {
-    const entries = await readdir(dir, { withFileTypes: true });
+    const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
-      const relativePath = relative(baseDir, fullPath);
+      const fullPath = join10(dir, entry.name);
+      const relativePath = relative2(baseDir, fullPath);
       if (entry.name === "node_modules" || entry.name === ".git") {
         continue;
       }
@@ -2777,7 +3057,7 @@ async function getFilesWithSizes(dir, baseDir) {
         const subFiles = await getFilesWithSizes(fullPath, baseDir);
         results.push(...subFiles);
       } else {
-        const fileStat = await stat(fullPath);
+        const fileStat = await stat6(fullPath);
         results.push({ path: relativePath, size: fileStat.size });
       }
     }
@@ -2810,7 +3090,7 @@ async function publishCommand(options) {
       files: manifest.files
     };
     if (options.bump) {
-      const semver2 = await import('semver');
+      const semver2 = await import("semver");
       const newVersion = semver2.default.inc(packageJson2.version, options.bump);
       if (!newVersion) {
         console.error(
@@ -2823,7 +3103,7 @@ async function publishCommand(options) {
     }
     const safeName = packageJson2.name.replace(/[@/]/g, "-").replace(/^-+/, "");
     const tarballName = `${safeName}-${packageJson2.version}.tgz`;
-    const tempDir = join(process.cwd(), ".pspm-publish");
+    const tempDir = join10(process.cwd(), ".pspm-publish");
     try {
       await exec(`rm -rf "${tempDir}" && mkdir -p "${tempDir}"`);
       const files = packageJson2.files || [...DEFAULT_SKILL_FILES];
@@ -2839,7 +3119,7 @@ async function publishCommand(options) {
       if (detection.type === "pspm.json") {
         await exec(`cp pspm.json "${tempDir}/package/"`);
         try {
-          await stat(join(process.cwd(), "package.json"));
+          await stat6(join10(process.cwd(), "package.json"));
           await exec(
             `cp package.json "${tempDir}/package/" 2>/dev/null || true`
           );
@@ -2848,30 +3128,30 @@ async function publishCommand(options) {
       } else {
         await exec(`cp package.json "${tempDir}/package/"`);
       }
-      const packageDir = join(tempDir, "package");
+      const packageDir = join10(tempDir, "package");
       const tarballContents = await getFilesWithSizes(packageDir, packageDir);
       const unpackedSize = tarballContents.reduce((acc, f) => acc + f.size, 0);
-      const tarballPath = join(tempDir, tarballName);
+      const tarballPath = join10(tempDir, tarballName);
       await exec(
         `tar -czf "${tarballPath}" -C "${tempDir}" --exclude='node_modules' --exclude='.git' package`
       );
-      const tarballBuffer = await readFile(tarballPath);
+      const tarballBuffer = await readFile6(tarballPath);
       const tarballBase64 = tarballBuffer.toString("base64");
       const tarballSize = tarballBuffer.length;
-      const shasum = createHash("sha1").update(tarballBuffer).digest("hex");
-      const integrityHash = createHash("sha512").update(tarballBuffer).digest("base64");
+      const shasum = createHash3("sha1").update(tarballBuffer).digest("hex");
+      const integrityHash = createHash3("sha512").update(tarballBuffer).digest("base64");
       const integrity = `sha512-${integrityHash}`;
       console.log("");
-      console.log(`pspm notice`);
+      console.log("pspm notice");
       console.log(`pspm notice \u{1F4E6}  ${packageJson2.name}@${packageJson2.version}`);
-      console.log(`pspm notice Tarball Contents`);
+      console.log("pspm notice Tarball Contents");
       tarballContents.sort((a, b) => b.size - a.size);
       for (const file of tarballContents) {
         console.log(
           `pspm notice ${formatBytes(file.size).padStart(8)} ${file.path}`
         );
       }
-      console.log(`pspm notice Tarball Details`);
+      console.log("pspm notice Tarball Details");
       console.log(`pspm notice name:          ${packageJson2.name}`);
       console.log(`pspm notice version:       ${packageJson2.version}`);
       console.log(`pspm notice filename:      ${tarballName}`);
@@ -2882,7 +3162,7 @@ async function publishCommand(options) {
         `pspm notice integrity:     ${integrity.substring(0, 50)}...`
       );
       console.log(`pspm notice total files:   ${tarballContents.length}`);
-      console.log(`pspm notice`);
+      console.log("pspm notice");
       console.log(`pspm notice Publishing to ${registryUrl} with tag latest`);
       configure2({ registryUrl, apiKey });
       const response = await publishSkill({
@@ -2892,7 +3172,7 @@ async function publishCommand(options) {
       if (response.status !== 200) {
         const errorMessage = extractApiErrorMessage(response, "Publish failed");
         if (errorMessage.includes("must be greater than") || errorMessage.includes("already exists")) {
-          console.error(`pspm error code E403`);
+          console.error("pspm error code E403");
           console.error(
             `pspm error 403 403 Forbidden - You cannot publish over the previously published versions: ${packageJson2.version}.`
           );
@@ -2936,6 +3216,16 @@ Setting visibility to ${options.access}...`);
     process.exit(1);
   }
 }
+// src/commands/remove.ts
+init_agents();
+init_config();
+init_lib();
+init_lockfile();
+init_manifest2();
+init_symlinks();
+import { rm as rm6 } from "fs/promises";
+import { join as join11 } from "path";
 async function remove(nameOrSpecifier) {
   try {
     const manifest = await readManifest();
@@ -2976,9 +3266,9 @@ async function removeRegistry(specifier, agents, agentConfigs) {
     agentConfigs
   });
   const skillsDir = getSkillsDir();
-  const destDir = join(skillsDir, username, name);
+  const destDir = join11(skillsDir, username, name);
   try {
-    await rm(destDir, { recursive: true, force: true });
+    await rm6(destDir, { recursive: true, force: true });
   } catch {
   }
   console.log(`Removed ${fullName}`);
@@ -3005,9 +3295,9 @@ async function removeGitHub(specifier, agents, agentConfigs) {
   });
   const skillsDir = getSkillsDir();
   const destPath = getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path);
-  const destDir = join(skillsDir, "..", destPath);
+  const destDir = join11(skillsDir, "..", destPath);
   try {
-    await rm(destDir, { recursive: true, force: true });
+    await rm6(destDir, { recursive: true, force: true });
   } catch {
   }
   console.log(`Removed ${lockfileKey}`);
@@ -3037,6 +3327,10 @@ async function removeByShortName(shortName, agents, agentConfigs) {
 }
 // src/commands/unpublish.ts
+init_api_client();
+init_config();
+init_errors();
+init_lib();
 async function unpublish(specifier, options) {
   try {
     const apiKey = await requireApiKey();
@@ -3095,6 +3389,12 @@ async function unpublish(specifier, options) {
 }
 // src/commands/update.ts
+init_api_client();
+init_config();
+init_errors();
+init_lib();
+init_lockfile();
+init_add();
 async function update(options) {
   try {
     const apiKey = await requireApiKey();
@@ -3156,7 +3456,7 @@ async function update(options) {
       if (!match) continue;
       const [, username, skillName] = match;
       const specifier = `@user/${username}/${skillName}@${latest}`;
-      await add(specifier, {});
+      await add([specifier], {});
     }
     console.log("\nAll skills updated.");
   } catch (error) {
@@ -3167,6 +3467,8 @@ async function update(options) {
 }
 // src/commands/whoami.ts
+init_api_client();
+init_config();
 async function whoami() {
   try {
     const resolved = await resolveConfig();
@@ -3192,13 +3494,13 @@ async function whoami() {
 }
 // src/index.ts
-var __dirname$1 = dirname(fileURLToPath(import.meta.url));
+var __dirname = dirname4(fileURLToPath(import.meta.url));
 var packageJson = JSON.parse(
-  readFileSync(join(__dirname$1, "..", "package.json"), "utf-8")
+  readFileSync(join12(__dirname, "..", "package.json"), "utf-8")
 );
 var version = packageJson.version;
 var program = new Command();
-program.name("pspm").description("Prompt Skill Package Manager for AnyT").version(version);
+program.name("pspm").description("Prompt Skill Package Manager for AI coding agents").version(version);
 var configCmd = program.command("config").description("Manage PSPM configuration");
 configCmd.command("show").description("Show resolved configuration").action(async () => {
   await configShow();
@@ -3234,13 +3536,13 @@ program.command("migrate").description(
 ).option("--dry-run", "Show what would be migrated without making changes").action(async (options) => {
   await migrate({ dryRun: options.dryRun });
 });
-program.command("add <specifier>").description(
-  "Add a skill (e.g., @user/bsheng/vite_slides@^2.0.0 or github:owner/repo/path@ref)"
+program.command("add <specifiers...>").description(
+  "Add one or more skills (e.g., @user/bsheng/vite_slides@^2.0.0 or github:owner/repo/path@ref)"
 ).option("--save", "Save to lockfile (default)").option(
   "--agent <agents>",
-  'Comma-separated agents for symlinks (default: "claude-code", use "none" to skip)'
-).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (specifier, options) => {
-  await add(specifier, {
+  'Comma-separated agents for symlinks (default: all agents, use "none" to skip)'
+).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (specifiers, options) => {
+  await add(specifiers, {
     save: options.save ?? true,
     agent: options.agent,
     yes: options.yes
@@ -3252,11 +3554,13 @@ program.command("remove <name>").alias("rm").description("Remove an installed sk
 program.command("list").alias("ls").description("List installed skills").option("--json", "Output as JSON").action(async (options) => {
   await list({ json: options.json });
 });
-program.command("install").alias("i").description("Install all skills from lockfile").option("--frozen-lockfile", "Fail if lockfile is missing or outdated").option("--dir <path>", "Install skills to a specific directory").option(
+program.command("install [specifiers...]").alias("i").description(
+  "Install skills from lockfile, or add and install specific packages"
+).option("--frozen-lockfile", "Fail if lockfile is missing or outdated").option("--dir <path>", "Install skills to a specific directory").option(
   "--agent <agents>",
-  'Comma-separated agents for symlinks (default: "claude-code", use "none" to skip)'
-).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (options) => {
-  await install({
+  'Comma-separated agents for symlinks (default: all agents, use "none" to skip)'
+).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (specifiers, options) => {
+  await install(specifiers, {
     frozenLockfile: options.frozenLockfile,
     dir: options.dir,
     agent: options.agent,
@@ -3265,7 +3569,7 @@ program.command("install").alias("i").description("Install all skills from lockf
 });
 program.command("link").description("Recreate agent symlinks without reinstalling").option(
   "--agent <agents>",
-  'Comma-separated agents for symlinks (default: "claude-code", use "none" to skip)'
+  'Comma-separated agents for symlinks (default: all agents, use "none" to skip)'
 ).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (options) => {
   await link({ agent: options.agent, yes: options.yes });
 });
@@ -3296,5 +3600,4 @@ program.command("deprecate <specifier> [message]").description(
   await deprecate(specifier, message, { undo: options.undo });
 });
 program.parse();
-//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map