@anytio/pspm 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -5,6 +5,59 @@ All notable changes to the PSPM CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] - 2026-02-09
+
+### Added
+
+- **Publish size limit (10MB)**: Packages exceeding 10MB are rejected with actionable suggestions
+  - Client-side validation catches oversized packages before upload
+  - Server-side schema validation updated from 50MB to 10MB
+  - Helpful error messages suggest using `files` field, `.pspmignore`, or removing build artifacts
+
+- **Publish preview with confirmation**: Users now see a full preview before publishing
+  - Displays tarball contents with file sizes (sorted by size)
+  - Shows package size, unpacked size, file count, and integrity hashes
+  - Requires explicit confirmation (`y/N`) before uploading to registry
+
+## [0.3.4] - 2026-01-29
+
+### Added
+
+- **`version` command**: Bump package version in `pspm.json` without publishing (like `npm version`)
+  - `pspm version major` - Bump major version (1.0.0 → 2.0.0)
+  - `pspm version minor` - Bump minor version (1.0.0 → 1.1.0)
+  - `pspm version patch` - Bump patch version (1.0.0 → 1.0.1)
+  - `pspm version patch --dry-run` - Preview changes without writing
+
+- **Visibility support for publish command**: Set package visibility during publish
+  - `pspm publish --access public` - Publish and make public in one step
+  - `pspm publish --access private` - Explicitly publish as private
+
+- **Dependency visibility in publish**: Published packages now include their dependencies in the manifest
+
+### Fixed
+
+- **Registry subdomain compatibility**: SDK now correctly handles registry URLs with subdomains
+- **Improved CLI error messages**: Better extraction and display of API error details
+
+## [0.3.3] - 2026-01-28
+
+### Fixed
+
+- Strip registry subdomain for web app and server URLs
+
+## [0.3.2] - 2026-01-28
+
+### Added
+
+- Registry subdomain support for multi-tenant deployments
+
+## [0.3.1] - 2026-01-27
+
+### Changed
+
+- Version bump for npm publish
+
 ## [0.3.0] - 2026-01-27
 
 ### Added
@@ -17,8 +70,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Local directory support (file: protocol)**: Install skills from local directories for development and testing
   - `pspm add file:../path/to/skill` - Install from local directory
+  - `pspm add ../my-skill` - Also works without the `file:` prefix
+  - Creates symlinks in `.pspm/skills/_local/{name}` for instant updates
   - `localDependencies` field in `pspm.json` for local packages
-  - Lockfile version bumped to 4 to support `localPackages`
+  - `localPackages` in lockfile (v4) tracks installed local packages
+  - Validates that directory exists and contains SKILL.md or pspm.json
+  - Provides helpful error messages: "Directory not found", "Not a valid skill directory"
+
+### Fixed
+
+- **Improved error messages for `access` command**: Now provides specific feedback for different specifier types
+  - GitHub specifiers explain that visibility only applies to registry packages
+  - Local file specifiers explain they are not registry packages
+  - Invalid registry specifiers show examples of correct format
 
 ## [0.2.0] - 2026-01-23
 

package/CLI_GUIDE.md

@@ -36,6 +36,7 @@ Commands:
   install|i [options] [specifiers...]        Install skills from lockfile, or add and install specific packages
   link [options]                             Recreate agent symlinks without reinstalling
   update [options]                           Update all skills to latest compatible versions
+  version <bump>                             Bump package version (major, minor, patch)
   publish [options]                          Publish current directory as a skill
   unpublish [options] <specifier>            Remove a published skill version (only within 72 hours of publishing)
   access [options] [specifier]               Change package visibility (public/private)
@@ -77,7 +78,7 @@ pspm whoami
 # Output:
 #   Username: myuser
 #   User ID: user_123
-#   Registry: https://pspm.dev
+#   Registry: https://registry.pspm.dev
 ```
 
 ## Configuration
@@ -92,7 +93,7 @@ pspm config show
 # Output:
 #   Resolved Configuration:
 #
-#     Registry URL:   https://pspm.dev
+#     Registry URL:   https://registry.pspm.dev
 #     API Key:        ***
 #     Username:       myuser
 #
@@ -158,6 +159,11 @@ pspm add github:owner/repo@main             # Entire repo, specific branch
 pspm add github:owner/repo/path/to/skill    # Subdirectory, default branch
 pspm add github:owner/repo/path@v1.0.0      # Subdirectory with tag/ref
 
+# Local directory specifiers (for development):
+pspm add file:../my-skill                   # Relative path
+pspm add file:./local-skill                 # Current directory relative
+pspm add file:/absolute/path/to/skill       # Absolute path
+
 # Add multiple skills at once:
 pspm add @user/alice/skill1 @user/bob/skill2
 
@@ -235,6 +241,30 @@ pspm update
 pspm update --dry-run    # Preview updates without applying
 ```
 
+## Versioning
+
+### Bump Version
+
+Bump the package version in `pspm.json` without publishing (similar to `npm version`):
+
+```bash
+pspm version <bump>
+
+# Bump types:
+pspm version major      # 1.0.0 → 2.0.0
+pspm version minor      # 1.0.0 → 1.1.0
+pspm version patch      # 1.0.0 → 1.0.1
+
+# Options:
+pspm version patch --dry-run   # Preview what would change
+```
+
+The command:
+- Reads the current version from `pspm.json`
+- Increments the version according to semver rules
+- Writes the updated version back to `pspm.json`
+- Outputs the new version (e.g., `v1.0.1`)
+
 ## Publishing
 
 ### Publish Skill
@@ -313,7 +343,7 @@ INI format configuration file:
 ```ini
 ; PSPM Configuration
 
-registry = https://pspm.dev
+registry = https://registry.pspm.dev
 authToken = sk_...
 username = myuser
 
@@ -345,7 +375,16 @@ Package manifest file (created with `pspm init`):
   "version": "1.0.0",
   "description": "A helpful skill for...",
   "author": "Your Name",
-  "files": ["pspm.json", "SKILL.md", "runtime", "scripts", "data"]
+  "files": ["pspm.json", "SKILL.md", "runtime", "scripts", "data"],
+  "dependencies": {
+    "@user/other/skill": "^1.0.0"
+  },
+  "githubDependencies": {
+    "github:owner/repo/skills/example": "main"
+  },
+  "localDependencies": {
+    "file:../my-local-skill": "*"
+  }
 }
 ```
 
@@ -353,12 +392,12 @@ Package manifest file (created with `pspm init`):
 
 ```json
 {
-  "lockfileVersion": 3,
-  "registryUrl": "https://pspm.dev",
+  "lockfileVersion": 4,
+  "registryUrl": "https://registry.pspm.dev",
   "packages": {
     "@user/bsheng/vite_slides": {
       "version": "2.0.0",
-      "resolved": "https://pspm.dev/...",
+      "resolved": "https://registry.pspm.dev/...",
       "integrity": "sha256-abc123..."
     }
   },
@@ -370,6 +409,14 @@ Package manifest file (created with `pspm init`):
       "gitCommit": "abc1234567890...",
       "gitRef": "main"
     }
+  },
+  "localPackages": {
+    "file:../my-local-skill": {
+      "version": "local",
+      "path": "../my-local-skill",
+      "resolvedPath": "/absolute/path/to/my-local-skill",
+      "name": "my-local-skill"
+    }
   }
 }
 ```
@@ -402,10 +449,12 @@ project/
 │   ├── skills/          # Installed skills
 │   │   ├── {username}/  # Registry skills
 │   │   │   └── {skillname}/
-│   │   └── _github/     # GitHub skills
-│   │       └── {owner}/
-│   │           └── {repo}/
-│   │               └── {path}/
+│   │   ├── _github/     # GitHub skills
+│   │   │   └── {owner}/
+│   │   │       └── {repo}/
+│   │   │           └── {path}/
+│   │   └── _local/      # Local skill symlinks
+│   │       └── {name} -> ../../../path/to/local/skill
 │   └── cache/           # Tarball cache
 ├── .claude/
 │   └── skills/          # Symlinks for claude-code agent
@@ -428,6 +477,31 @@ export PSPM_API_KEY=sk_ci_key
 pspm install --frozen-lockfile
 ```
 
+### Local Development Workflow
+
+Use local dependencies to develop and test skills before publishing:
+
+```bash
+# Add a local skill for development
+pspm add file:../my-skill
+
+# The skill is symlinked, so changes are instant
+# No need to reinstall after editing the local skill
+
+# When ready to publish
+cd ../my-skill
+pspm publish
+```
+
+In your `pspm.json`:
+```json
+{
+  "localDependencies": {
+    "file:../my-local-skill": "*"
+  }
+}
+```
+
 ### Publishing Workflow
 
 ```bash

package/README.md

@@ -113,6 +113,15 @@ pspm link --agent codex                          # Recreate symlinks for specifi
 
 Default is all agents (`claude-code`, `codex`, `cursor`, `gemini`, `kiro`, `opencode`). Use `--agent claude-code` to install for a single agent.
 
+### Versioning
+
+```bash
+pspm version major            # Bump major version (1.0.0 → 2.0.0)
+pspm version minor            # Bump minor version (1.0.0 → 1.1.0)
+pspm version patch            # Bump patch version (1.0.0 → 1.0.1)
+pspm version patch --dry-run  # Preview changes without writing
+```
+
 ### Publishing
 
 ```bash
@@ -123,6 +132,9 @@ pspm unpublish <spec> --force # Remove a published skill version
 pspm deprecate <spec> [msg]   # Mark a version as deprecated
 ```
 
+**Publish preview:** Before uploading, `pspm publish` shows a preview of included files, package size, and requires confirmation. Max package size is **10MB**.
+
+
 ### Visibility
 
 ```bash
@@ -147,7 +159,7 @@ PSPM uses a simple npm-like INI configuration format.
 
 ```ini
 ; PSPM Configuration
-registry = https://pspm.dev
+registry = https://registry.pspm.dev
 authToken = sk_...
 username = myuser
 ```
@@ -165,12 +177,12 @@ registry = https://custom-registry.example.com
 
 ```json
 {
-  "lockfileVersion": 3,
-  "registryUrl": "https://pspm.dev",
+  "lockfileVersion": 4,
+  "registryUrl": "https://registry.pspm.dev",
   "packages": {
     "@user/username/skillname": {
       "version": "1.0.0",
-      "resolved": "https://pspm.dev/...",
+      "resolved": "https://registry.pspm.dev/@user/username/skillname/1.0.0",
       "integrity": "sha256-..."
     }
   },
@@ -182,6 +194,14 @@ registry = https://custom-registry.example.com
       "gitCommit": "abc1234567890...",
       "gitRef": "main"
     }
+  },
+  "localPackages": {
+    "file:../my-local-skill": {
+      "version": "local",
+      "path": "../my-local-skill",
+      "resolvedPath": "/absolute/path/to/my-local-skill",
+      "name": "my-local-skill"
+    }
   }
 }
 ```
@@ -206,11 +226,13 @@ project/
 │   │   ├── username/    # Registry skills
 │   │   │   └── skillname/
 │   │   │       └── SKILL.md
-│   │   └── _github/     # GitHub skills
-│   │       └── owner/
-│   │           └── repo/
-│   │               └── path/
-│   │                   └── SKILL.md
+│   │   ├── _github/     # GitHub skills
+│   │   │   └── owner/
+│   │   │       └── repo/
+│   │   │           └── path/
+│   │   │               └── SKILL.md
+│   │   └── _local/      # Local skill symlinks
+│   │       └── skillname -> ../../../path/to/local/skill
 │   └── cache/           # Tarball cache
 ├── .claude/
 │   └── skills/          # Symlinks for claude-code agent