@anytio/pspm 0.14.1 → 0.15.0

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to the PSPM CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.0] - 2026-05-28
+
+### Changed
+
+- **Visibility is now fully reversible.** Public skills can be made private again (previously a one-way, npm-style lock). Use `pspm access --private` or republish with `--access private`. Switching to private still requires a Pro subscription. Publish/access prompts and notes no longer warn that going public is irreversible.
+
+### Fixed
+
+- **Failed publishes no longer orphan a skill record.** The server now uploads the tarball before any database writes and creates the skill row and its first version inside a single transaction. Previously, a publish that failed partway (e.g. a storage error after the skill row was created) left behind a versionless skill that was invisible in listings yet permanently reserved the name — and, combined with the old one-way visibility lock, could block ever publishing that name as private.
+
 ## [0.14.1] - 2026-05-02
 
 ### Changed

package/dist/index.js

@@ -30,7 +30,8 @@ function isLocalSpecifier(specifier) {
 *   pspm access --public              # Make current package public
 *   pspm access @user/bob/skill --public  # Make specific package public
 *
-* Note: Making a package public is irreversible (like npm).
+* Visibility is fully reversible: public packages can be made private and
+* private packages can be made public. Switching to private requires Pro.
 */
 async function access$1(specifier, options) {
 	try {
@@ -120,7 +121,7 @@ async function access$1(specifier, options) {
 		console.log(`+ @${result.namespace ?? "user"}/${result.username}/${result.name} is now ${result.visibility}`);
 		if (visibility === "public") {
 			console.log("");
-			console.log("Note: This action is irreversible. Public packages cannot be made private.");
+			console.log("Note: Run 'pspm access --private' to make it private again later.");
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
@@ -1536,8 +1537,8 @@ async function warnAndConfirmPublic(access) {
 	if (access !== "public") return;
 	console.log("");
 	console.log("⚠️  Warning: You are about to publish this skill as PUBLIC.");
-	console.log("   Once a skill is public, it CANNOT be made private again.");
-	console.log("   This action is irreversible.");
+	console.log("   Anyone will be able to find and install it.");
+	console.log("   You can change it back to private later with 'pspm access'.");
 	console.log("");
 	if (!await confirm("Do you want to continue?")) {
 		console.log("Publish cancelled.");
@@ -1707,7 +1708,7 @@ function printPublishResult(result, options, packageJson) {
 	console.log(`+ @${namespace}/${owner}/${result.skill.name}@${result.version.version}`);
 	console.log(`Checksum: ${result.version.checksum}`);
 	console.log(`Visibility: ${visibilityIcon} ${visibility}${packageJson.encryption ? " (encrypted)" : ""}`);
-	if (visibility === "public") console.log("Note: Public packages cannot be made private. This is irreversible.");
+	if (visibility === "public") console.log("Note: Run 'pspm access --private' to make it private again later.");
 }
 async function publishCommand(options) {
 	try {
@@ -2664,7 +2665,7 @@ function registerPublishCommands(program) {
 	program.command("unpublish <specifier>").description("Remove a published skill version (only within 72 hours of publishing)").option("--force", "Confirm destructive action").action(async (specifier, options) => {
 		await unpublish(specifier, { force: options.force });
 	});
-	program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public (irreversible)").option("--private", "Make the package private (only for private packages)").action(async (specifier, options) => {
+	program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public").option("--private", "Make the package private (requires Pro)").action(async (specifier, options) => {
 		await access$1(specifier, {
 			public: options.public,
 			private: options.private

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anytio/pspm",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "CLI for PSPM - Package manager for AI agent skills",
   "author": "anyt.io",
   "license": "Artistic-2.0",
@@ -55,8 +55,8 @@
     "vitest": "^4.1.5",
     "@anytio/errors": "0.0.0",
     "@anytio/typescript-config": "0.0.0",
-    "@anytio/skill-registry": "0.0.1",
-    "@anytio/skill-types": "0.0.1"
+    "@anytio/skill-types": "0.0.1",
+    "@anytio/skill-registry": "0.0.1"
   },
   "engines": {
     "node": ">=20.0.0"