@anytio/pspm 0.14.1 → 0.15.1

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to the PSPM CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.1] - 2026-05-28
+
+### Fixed
+
+- **Publishing a `@user` skill no longer collides with a same-named GitHub-indexed skill.** GitHub-indexed skills are stored under the indexer's admin user, so for that account a `@user` publish could match an indexed `@github` skill of the same name and inherit its calendar version (`YYYY.M.D`) — making every `0.x` publish fail with "must be greater than existing version 2026.x.x". The publish/lookup query is now scoped to the `@user` namespace.
+- **Clearer publish errors.** Version-bump and duplicate-version failures now print a single accurate message with the offending version and what to do next, instead of mislabelling an HTTP 400 as `E403 / 403 Forbidden`.
+
+## [0.15.0] - 2026-05-28
+
+### Changed
+
+- **Visibility is now fully reversible.** Public skills can be made private again (previously a one-way, npm-style lock). Use `pspm access --private` or republish with `--access private`. Switching to private still requires a Pro subscription. Publish/access prompts and notes no longer warn that going public is irreversible.
+
+### Fixed
+
+- **Failed publishes no longer orphan a skill record.** The server now uploads the tarball before any database writes and creates the skill row and its first version inside a single transaction. Previously, a publish that failed partway (e.g. a storage error after the skill row was created) left behind a versionless skill that was invisible in listings yet permanently reserved the name — and, combined with the old one-way visibility lock, could block ever publishing that name as private.
+
 ## [0.14.1] - 2026-05-02
 
 ### Changed

package/dist/index.js

@@ -30,7 +30,8 @@ function isLocalSpecifier(specifier) {
 *   pspm access --public              # Make current package public
 *   pspm access @user/bob/skill --public  # Make specific package public
 *
-* Note: Making a package public is irreversible (like npm).
+* Visibility is fully reversible: public packages can be made private and
+* private packages can be made public. Switching to private requires Pro.
 */
 async function access$1(specifier, options) {
 	try {
@@ -120,7 +121,7 @@ async function access$1(specifier, options) {
 		console.log(`+ @${result.namespace ?? "user"}/${result.username}/${result.name} is now ${result.visibility}`);
 		if (visibility === "public") {
 			console.log("");
-			console.log("Note: This action is irreversible. Public packages cannot be made private.");
+			console.log("Note: Run 'pspm access --private' to make it private again later.");
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
@@ -1536,8 +1537,8 @@ async function warnAndConfirmPublic(access) {
 	if (access !== "public") return;
 	console.log("");
 	console.log("⚠️  Warning: You are about to publish this skill as PUBLIC.");
-	console.log("   Once a skill is public, it CANNOT be made private again.");
-	console.log("   This action is irreversible.");
+	console.log("   Anyone will be able to find and install it.");
+	console.log("   You can change it back to private later with 'pspm access'.");
 	console.log("");
 	if (!await confirm("Do you want to continue?")) {
 		console.log("Publish cancelled.");
@@ -1693,11 +1694,21 @@ function handleUploadError(response, version) {
 		status: response.status,
 		data: response.data
 	}, "Publish failed");
-	if (errorMessage.includes("must be greater than") || errorMessage.includes("already exists")) {
-		console.error("pspm error code E403");
-		console.error(`pspm error 403 403 Forbidden - You cannot publish over the previously published versions: ${version}.`);
+	if (errorMessage.includes("must be greater than")) {
+		const existing = errorMessage.match(/existing version ([\w.+-]+)/)?.[1];
+		console.error(`Error: cannot publish ${version} — a higher version exists.`);
+		if (existing) console.error(`  The latest published version is ${existing}. Publish a version greater than ${existing}.`);
+		else console.error("  Bump to a greater version and try again.");
+		process.exit(1);
+	}
+	if (errorMessage.includes("already exists")) {
+		console.error(`Error: version ${version} has already been published.`);
+		console.error("  Published versions are immutable — bump the version in pspm.json and try again.");
+		process.exit(1);
 	}
-	throw new Error(errorMessage);
+	console.error(`Error: publish failed (HTTP ${response.status}).`);
+	console.error(`  ${errorMessage}`);
+	process.exit(1);
 }
 function printPublishResult(result, options, packageJson) {
 	const visibility = result.skill.visibility;
@@ -1707,7 +1718,7 @@ function printPublishResult(result, options, packageJson) {
 	console.log(`+ @${namespace}/${owner}/${result.skill.name}@${result.version.version}`);
 	console.log(`Checksum: ${result.version.checksum}`);
 	console.log(`Visibility: ${visibilityIcon} ${visibility}${packageJson.encryption ? " (encrypted)" : ""}`);
-	if (visibility === "public") console.log("Note: Public packages cannot be made private. This is irreversible.");
+	if (visibility === "public") console.log("Note: Run 'pspm access --private' to make it private again later.");
 }
 async function publishCommand(options) {
 	try {
@@ -2664,7 +2675,7 @@ function registerPublishCommands(program) {
 	program.command("unpublish <specifier>").description("Remove a published skill version (only within 72 hours of publishing)").option("--force", "Confirm destructive action").action(async (specifier, options) => {
 		await unpublish(specifier, { force: options.force });
 	});
-	program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public (irreversible)").option("--private", "Make the package private (only for private packages)").action(async (specifier, options) => {
+	program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public").option("--private", "Make the package private (requires Pro)").action(async (specifier, options) => {
 		await access$1(specifier, {
 			public: options.public,
 			private: options.private

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anytio/pspm",
-  "version": "0.14.1",
+  "version": "0.15.1",
   "description": "CLI for PSPM - Package manager for AI agent skills",
   "author": "anyt.io",
   "license": "Artistic-2.0",
@@ -53,10 +53,10 @@
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.5",
-    "@anytio/errors": "0.0.0",
-    "@anytio/typescript-config": "0.0.0",
     "@anytio/skill-registry": "0.0.1",
-    "@anytio/skill-types": "0.0.1"
+    "@anytio/skill-types": "0.0.1",
+    "@anytio/typescript-config": "0.0.0",
+    "@anytio/errors": "0.0.0"
   },
   "engines": {
     "node": ">=20.0.0"