@anytio/pspm 0.3.0 → 0.4.0

package/dist/index.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
-import { stat, writeFile, readdir, mkdir, rm, rename, access as access$1, readFile, lstat, unlink, cp, readlink, symlink } from 'fs/promises';
+import { stat, writeFile, readdir, mkdir, rm, rename, access as access$1, readFile, symlink, lstat, unlink, cp, readlink } from 'fs/promises';
 import { homedir } from 'os';
-import { dirname, join, basename, relative } from 'path';
+import { dirname, join, basename, resolve, relative } from 'path';
 import * as ini from 'ini';
 import ignore from 'ignore';
 import { createHash, randomBytes } from 'crypto';
 import * as semver from 'semver';
+import semver__default from 'semver';
 import { checkbox } from '@inquirer/prompts';
 import { readFileSync } from 'fs';
 import { fileURLToPath, URL as URL$1 } from 'url';
@@ -26,7 +27,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// ../../packages/shared/sdk/src/fetcher.ts
+// src/sdk/fetcher.ts
 function configure(options) {
   config = options;
 }
@@ -67,15 +68,15 @@ async function customFetch(url, options) {
 }
 var config;
 var init_fetcher = __esm({
-  "../../packages/shared/sdk/src/fetcher.ts"() {
+  "src/sdk/fetcher.ts"() {
     config = null;
   }
 });
 
-// ../../packages/shared/sdk/src/generated/index.ts
+// src/sdk/generated/index.ts
 var getMeUrl, me, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getPublishSkillUrl, publishSkill, getDeleteSkillUrl, deleteSkill, getDeleteSkillVersionUrl, deleteSkillVersion;
 var init_generated = __esm({
-  "../../packages/shared/sdk/src/generated/index.ts"() {
+  "src/sdk/generated/index.ts"() {
     init_fetcher();
     getMeUrl = () => {
       return `/api/skills/me`;
@@ -101,12 +102,12 @@ var init_generated = __esm({
         }
       );
     };
-    getGetSkillVersionUrl = (username, name, version2) => {
-      return `/api/skills/@user/${username}/${name}/${version2}`;
+    getGetSkillVersionUrl = (username, name, version3) => {
+      return `/api/skills/@user/${username}/${name}/${version3}`;
     };
-    getSkillVersion = async (username, name, version2, options) => {
+    getSkillVersion = async (username, name, version3, options) => {
       return customFetch(
-        getGetSkillVersionUrl(username, name, version2),
+        getGetSkillVersionUrl(username, name, version3),
         {
           ...options,
           method: "GET"
@@ -141,12 +142,12 @@ var init_generated = __esm({
         }
       );
     };
-    getDeleteSkillVersionUrl = (name, version2) => {
-      return `/api/skills/${name}/${version2}`;
+    getDeleteSkillVersionUrl = (name, version3) => {
+      return `/api/skills/${name}/${version3}`;
     };
-    deleteSkillVersion = async (name, version2, options) => {
+    deleteSkillVersion = async (name, version3, options) => {
       return customFetch(
-        getDeleteSkillVersionUrl(name, version2),
+        getDeleteSkillVersionUrl(name, version3),
         {
           ...options,
           method: "DELETE"
@@ -156,14 +157,6 @@ var init_generated = __esm({
   }
 });
 
-// ../../packages/shared/sdk/src/index.ts
-var init_src = __esm({
-  "../../packages/shared/sdk/src/index.ts"() {
-    init_fetcher();
-    init_generated();
-  }
-});
-
 // src/api-client.ts
 function registryUrlToBaseUrl(registryUrl) {
   return registryUrl.replace(/\/api\/skills\/?$/, "");
@@ -188,14 +181,14 @@ async function whoamiRequest(registryUrl, apiKey) {
     return null;
   }
 }
-async function deprecateSkillVersion(skillName, version2, message) {
+async function deprecateSkillVersion(skillName, version3, message) {
   const config2 = getConfig();
   if (!config2) {
     return { status: 401, error: "SDK not configured" };
   }
   try {
     const response = await fetch(
-      `${config2.baseUrl}/api/skills/${skillName}/${version2}/deprecate`,
+      `${config2.baseUrl}/api/skills/${skillName}/${version3}/deprecate`,
       {
         method: "POST",
         headers: {
@@ -218,14 +211,14 @@ async function deprecateSkillVersion(skillName, version2, message) {
     };
   }
 }
-async function undeprecateSkillVersion(skillName, version2) {
+async function undeprecateSkillVersion(skillName, version3) {
   const config2 = getConfig();
   if (!config2) {
     return { status: 401, error: "SDK not configured" };
   }
   try {
     const response = await fetch(
-      `${config2.baseUrl}/api/skills/${skillName}/${version2}/deprecate`,
+      `${config2.baseUrl}/api/skills/${skillName}/${version3}/deprecate`,
       {
         method: "DELETE",
         headers: {
@@ -286,11 +279,27 @@ async function changeSkillAccess(skillName, input) {
 }
 var init_api_client = __esm({
   "src/api-client.ts"() {
-    init_src();
+    init_fetcher();
+    init_generated();
   }
 });
 
 // src/errors.ts
+function getHttpStatusDescription(status) {
+  const descriptions = {
+    400: "Bad Request - The request was malformed",
+    401: "Unauthorized - Please run 'pspm login' first",
+    403: "Forbidden - You don't have permission for this action",
+    404: "Not Found - The endpoint or resource doesn't exist",
+    409: "Conflict - The resource already exists or there's a version conflict",
+    422: "Validation Error - The request data is invalid",
+    429: "Too Many Requests - Please slow down and try again",
+    500: "Internal Server Error - Something went wrong on the server",
+    502: "Bad Gateway - The server is temporarily unavailable",
+    503: "Service Unavailable - The server is temporarily unavailable"
+  };
+  return descriptions[status] || `HTTP Error ${status}`;
+}
 function extractApiErrorMessage(response, fallbackMessage) {
   const errorData = response.data;
   if (process.env.PSPM_DEBUG) {
@@ -300,8 +309,20 @@ function extractApiErrorMessage(response, fallbackMessage) {
       JSON.stringify(errorData, null, 2)
     );
   }
-  if (!errorData) {
-    return `${fallbackMessage} (HTTP ${response.status})`;
+  if (typeof errorData === "string") {
+    if (response.status === 404) {
+      return `${fallbackMessage}: ${getHttpStatusDescription(404)}
+The registry endpoint may be unavailable or misconfigured.`;
+    }
+    return `${fallbackMessage}: ${errorData} (HTTP ${response.status})`;
+  }
+  if (!errorData || typeof errorData !== "object") {
+    const statusDesc = getHttpStatusDescription(response.status);
+    if (response.status === 404) {
+      return `${fallbackMessage}: ${statusDesc}
+Check that the registry URL is correct in your config.`;
+    }
+    return `${fallbackMessage}: ${statusDesc}`;
   }
   let errorMessage = errorData.message || fallbackMessage;
   if (errorData.code === "VALIDATION_ERROR" && errorData.details) {
@@ -319,6 +340,9 @@ ${issueMessages}`;
   if (errorData.code && !errorMessage.includes(errorData.code)) {
     errorMessage = `[${errorData.code}] ${errorMessage}`;
   }
+  if (response.status >= 400) {
+    errorMessage += ` (HTTP ${response.status})`;
+  }
   if (errorData.requestId) {
     errorMessage += `
 (Request ID: ${errorData.requestId})`;
@@ -617,7 +641,7 @@ var DEFAULT_REGISTRY_URL;
 var init_config = __esm({
   "src/config.ts"() {
     init_errors();
-    DEFAULT_REGISTRY_URL = "https://pspm.dev";
+    DEFAULT_REGISTRY_URL = "https://registry.pspm.dev";
   }
 });
 async function loadIgnorePatterns(cwd = process.cwd()) {
@@ -668,6 +692,14 @@ var init_integrity = __esm({
   }
 });
 
+// src/lib/lockfile.ts
+var PSPM_LOCKFILE_SCHEMA_URL;
+var init_lockfile = __esm({
+  "src/lib/lockfile.ts"() {
+    PSPM_LOCKFILE_SCHEMA_URL = "https://pspm.dev/schema/v1/pspm-lock.json";
+  }
+});
+
 // src/lib/manifest.ts
 function validateManifest(manifest) {
   if (!manifest.name) {
@@ -715,12 +747,12 @@ function findHighestSatisfying(ranges, availableVersions) {
   const normalizedRanges = ranges.map(
     (r) => !r || r === "latest" || r === "*" ? "*" : r
   );
-  for (const version2 of sorted) {
+  for (const version3 of sorted) {
     const satisfiesAll = normalizedRanges.every(
-      (range) => semver.satisfies(version2, range)
+      (range) => semver.satisfies(version3, range)
     );
     if (satisfiesAll) {
-      return version2;
+      return version3;
     }
   }
   return null;
@@ -1111,6 +1143,7 @@ var init_lib = __esm({
   "src/lib/index.ts"() {
     init_ignore();
     init_integrity();
+    init_lockfile();
     init_manifest();
     init_resolver();
     init_specifier();
@@ -1303,8 +1336,8 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
         const rootEntries = await readdir(sourcePath);
         const dirs = [];
         for (const entry of rootEntries) {
-          const stat7 = await lstat(join(sourcePath, entry)).catch(() => null);
-          if (stat7?.isDirectory() && !entry.startsWith(".")) {
+          const stat8 = await lstat(join(sourcePath, entry)).catch(() => null);
+          if (stat8?.isDirectory() && !entry.startsWith(".")) {
             dirs.push(entry);
           }
         }
@@ -1439,15 +1472,19 @@ async function writeLockfile(lockfile) {
   const hasDependencies = Object.values(packages).some(
     (pkg) => pkg.dependencies && Object.keys(pkg.dependencies).length > 0
   );
-  const version2 = hasDependencies ? 4 : 3;
+  const version3 = hasDependencies ? 4 : 3;
   const normalized = {
-    lockfileVersion: version2,
+    $schema: PSPM_LOCKFILE_SCHEMA_URL,
+    lockfileVersion: version3,
     registryUrl: lockfile.registryUrl,
     packages
   };
   if (lockfile.githubPackages && Object.keys(lockfile.githubPackages).length > 0) {
     normalized.githubPackages = lockfile.githubPackages;
   }
+  if (lockfile.localPackages && Object.keys(lockfile.localPackages).length > 0) {
+    normalized.localPackages = lockfile.localPackages;
+  }
   await writeFile(lockfilePath, `${JSON.stringify(normalized, null, 2)}
 `);
 }
@@ -1541,9 +1578,21 @@ async function listLockfileGitHubPackages() {
     entry
   }));
 }
-var init_lockfile = __esm({
+async function addLocalToLockfile(specifier, entry) {
+  let lockfile = await readLockfile();
+  if (!lockfile) {
+    lockfile = await createEmptyLockfile();
+  }
+  if (!lockfile.localPackages) {
+    lockfile.localPackages = {};
+  }
+  lockfile.localPackages[specifier] = entry;
+  await writeLockfile(lockfile);
+}
+var init_lockfile2 = __esm({
   "src/lockfile.ts"() {
     init_config();
+    init_lib();
   }
 });
 function getManifestPath() {
@@ -1617,6 +1666,14 @@ async function removeGitHubDependency(specifier) {
   await writeManifest(manifest);
   return true;
 }
+async function addLocalDependency(specifier, version3 = "*") {
+  const manifest = await ensureManifest();
+  if (!manifest.localDependencies) {
+    manifest.localDependencies = {};
+  }
+  manifest.localDependencies[specifier] = version3;
+  await writeManifest(manifest);
+}
 var init_manifest2 = __esm({
   "src/manifest.ts"() {
   }
@@ -1696,6 +1753,9 @@ function getGitHubSkillPath(owner, repo, path) {
   }
   return `.pspm/skills/_github/${owner}/${repo}`;
 }
+function getLocalSkillPath(skillName) {
+  return `.pspm/skills/_local/${skillName}`;
+}
 async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
   const linkedAgents = [];
   for (const agentName of agents) {
@@ -1723,13 +1783,31 @@ var add_exports = {};
 __export(add_exports, {
   add: () => add
 });
+function isLocalSpecifier2(specifier) {
+  return specifier.startsWith("file:") || specifier.startsWith("./") || specifier.startsWith("../");
+}
+function parseLocalPath(specifier) {
+  if (specifier.startsWith("file:")) {
+    return specifier.slice(5);
+  }
+  return specifier;
+}
+function normalizeToFileSpecifier(path) {
+  if (path.startsWith("file:")) {
+    return path;
+  }
+  return `file:${path}`;
+}
 async function add(specifiers, options) {
   console.log("Resolving packages...\n");
   const resolvedPackages = [];
   const validationErrors = [];
   for (const specifier of specifiers) {
     try {
-      if (isGitHubSpecifier(specifier)) {
+      if (isLocalSpecifier2(specifier)) {
+        const resolved = await validateLocalPackage(specifier);
+        resolvedPackages.push(resolved);
+      } else if (isGitHubSpecifier(specifier)) {
         const resolved = await validateGitHubPackage(specifier);
         resolvedPackages.push(resolved);
       } else {
@@ -1761,6 +1839,9 @@ async function add(specifiers, options) {
   const githubPackages = resolvedPackages.filter(
     (p) => p.type === "github"
   );
+  const localPackages = resolvedPackages.filter(
+    (p) => p.type === "local"
+  );
   let resolutionResult = null;
   if (registryPackages.length > 0) {
     const rootDeps = {};
@@ -1845,6 +1926,24 @@ async function add(specifiers, options) {
         error: message
       });
       console.error(`Failed to install ${resolved.specifier}: ${message}
+`);
+    }
+  }
+  for (const resolved of localPackages) {
+    try {
+      await installLocalPackage(resolved, {
+        ...options,
+        resolvedAgents: agents
+      });
+      results.push({ specifier: resolved.specifier, success: true });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      results.push({
+        specifier: resolved.specifier,
+        success: false,
+        error: message
+      });
+      console.error(`Failed to install ${resolved.specifier}: ${message}
 `);
     }
   }
@@ -2069,6 +2168,91 @@ async function installGitHubPackage(resolved, options) {
   );
   console.log(`Location: ${destPath}`);
 }
+async function validateLocalPackage(specifier) {
+  const path = parseLocalPath(specifier);
+  const resolvedPath = resolve(process.cwd(), path);
+  const normalizedSpecifier = normalizeToFileSpecifier(path);
+  console.log(`Resolving ${specifier}...`);
+  try {
+    const stats = await stat(resolvedPath);
+    if (!stats.isDirectory()) {
+      throw new Error(`Path is not a directory: ${resolvedPath}`);
+    }
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(
+        `Directory not found: ${resolvedPath}
+  Check that the path exists and is accessible.`
+      );
+    }
+    throw error;
+  }
+  let hasSkillMd = false;
+  let hasPspmJson = false;
+  try {
+    await stat(join(resolvedPath, "SKILL.md"));
+    hasSkillMd = true;
+  } catch {
+  }
+  try {
+    await stat(join(resolvedPath, "pspm.json"));
+    hasPspmJson = true;
+  } catch {
+  }
+  if (!hasSkillMd && !hasPspmJson) {
+    throw new Error(
+      `Not a valid skill directory: ${resolvedPath}
+  Missing both SKILL.md and pspm.json. At least one is required.`
+    );
+  }
+  const name = basename(resolvedPath);
+  console.log(`Resolved ${specifier} -> ${resolvedPath}`);
+  return {
+    type: "local",
+    specifier,
+    normalizedSpecifier,
+    path,
+    resolvedPath,
+    name
+  };
+}
+async function installLocalPackage(resolved, options) {
+  const { specifier, normalizedSpecifier, path, resolvedPath, name } = resolved;
+  console.log(`Installing ${specifier}...`);
+  const skillsDir = getSkillsDir();
+  const localSkillsDir = join(skillsDir, "_local");
+  await mkdir(localSkillsDir, { recursive: true });
+  const symlinkPath = join(localSkillsDir, name);
+  const relativeTarget = relative(dirname(symlinkPath), resolvedPath);
+  try {
+    await rm(symlinkPath, { force: true });
+  } catch {
+  }
+  await symlink(relativeTarget, symlinkPath);
+  const entry = {
+    version: "local",
+    path,
+    resolvedPath,
+    name
+  };
+  await addLocalToLockfile(normalizedSpecifier, entry);
+  await addLocalDependency(normalizedSpecifier);
+  const agents = options.resolvedAgents;
+  if (agents[0] !== "none") {
+    const manifest = await readManifest();
+    const skillInfo = {
+      name,
+      sourcePath: getLocalSkillPath(name)
+    };
+    await createAgentSymlinks([skillInfo], {
+      agents,
+      projectRoot: process.cwd(),
+      agentConfigs: manifest?.agents
+    });
+  }
+  console.log(`Installed ${specifier} (local)`);
+  console.log(`Location: ${symlinkPath} -> ${resolvedPath}`);
+}
 var init_add = __esm({
   "src/commands/add.ts"() {
     init_agents();
@@ -2077,7 +2261,7 @@ var init_add = __esm({
     init_errors();
     init_github();
     init_lib();
-    init_lockfile();
+    init_lockfile2();
     init_manifest2();
     init_symlinks();
   }
@@ -2087,6 +2271,9 @@ var init_add = __esm({
 init_api_client();
 init_config();
 init_lib();
+function isLocalSpecifier(specifier) {
+  return specifier.startsWith("file:") || specifier.startsWith("./") || specifier.startsWith("../");
+}
 async function access(specifier, options) {
   try {
     const apiKey = await requireApiKey();
@@ -2102,10 +2289,41 @@ async function access(specifier, options) {
     const visibility = options.public ? "public" : "private";
     let packageName;
     if (specifier) {
+      if (isGitHubSpecifier(specifier)) {
+        const ghSpec = parseGitHubSpecifier(specifier);
+        if (ghSpec) {
+          console.error(`Error: Cannot change visibility of GitHub packages.`);
+          console.error(
+            `  "${specifier}" is hosted on GitHub, not the PSPM registry.`
+          );
+          console.error(
+            `  Visibility can only be changed for packages published to the registry.`
+          );
+        } else {
+          console.error(`Error: Invalid GitHub specifier "${specifier}".`);
+          console.error(`  Use format: github:{owner}/{repo}[/{path}][@{ref}]`);
+        }
+        process.exit(1);
+      }
+      if (isLocalSpecifier(specifier)) {
+        console.error(`Error: Cannot change visibility of local packages.`);
+        console.error(
+          `  "${specifier}" is a local directory, not a registry package.`
+        );
+        console.error(
+          `  Visibility can only be changed for packages published to the registry.`
+        );
+        process.exit(1);
+      }
       const parsed = parseSkillSpecifier(specifier);
       if (!parsed) {
+        console.error(`Error: Invalid package specifier "${specifier}".`);
+        console.error(`  Use format: @user/{username}/{name}`);
+        console.error(``);
+        console.error(`  Examples:`);
+        console.error(`    pspm access @user/myname/my-skill --public`);
         console.error(
-          `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}`
+          `    pspm access --public  (uses current directory's pspm.json)`
         );
         process.exit(1);
       }
@@ -2301,10 +2519,10 @@ async function deprecate(specifier, message, options) {
 // src/commands/init.ts
 init_lib();
 function prompt(rl, question, defaultValue) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const displayDefault = defaultValue ? ` (${defaultValue})` : "";
     rl.question(`${question}${displayDefault} `, (answer) => {
-      resolve(answer.trim() || defaultValue);
+      resolve2(answer.trim() || defaultValue);
     });
   });
 }
@@ -2355,8 +2573,8 @@ function sanitizeName(name) {
 function isValidName(name) {
   return /^[a-z][a-z0-9_-]*$/.test(name);
 }
-function isValidVersion(version2) {
-  return /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version2);
+function isValidVersion(version3) {
+  return /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version3);
 }
 async function init(options) {
   try {
@@ -2428,10 +2646,10 @@ async function init(options) {
           );
           name = await prompt(rl, "skill name:", sanitizeName(name));
         }
-        let version2 = await prompt(rl, "version:", defaultVersion);
-        while (!isValidVersion(version2)) {
+        let version3 = await prompt(rl, "version:", defaultVersion);
+        while (!isValidVersion(version3)) {
           console.log("  Version must be valid semver (e.g., 1.0.0)");
-          version2 = await prompt(rl, "version:", "0.1.0");
+          version3 = await prompt(rl, "version:", "0.1.0");
         }
         const description = await prompt(
           rl,
@@ -2451,7 +2669,7 @@ async function init(options) {
         manifest = {
           $schema: PSPM_SCHEMA_URL,
           name,
-          version: version2,
+          version: version3,
           description: description || void 0,
           author: author || void 0,
           license,
@@ -2488,9 +2706,9 @@ async function init(options) {
         input: process.stdin,
         output: process.stdout
       });
-      const confirm = await prompt(rl, "Is this OK?", "yes");
+      const confirm2 = await prompt(rl, "Is this OK?", "yes");
       rl.close();
-      if (confirm.toLowerCase() !== "yes" && confirm.toLowerCase() !== "y") {
+      if (confirm2.toLowerCase() !== "yes" && confirm2.toLowerCase() !== "y") {
         console.log("Aborted.");
         process.exit(0);
       }
@@ -2523,7 +2741,7 @@ init_config();
 init_errors();
 init_github();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
 function getCacheFilePath(cacheDir, integrity) {
@@ -2937,7 +3155,7 @@ All ${totalCount} skill(s) installed.`);
 // src/commands/link.ts
 init_agents();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
 async function link(options) {
@@ -3014,7 +3232,7 @@ async function link(options) {
 // src/commands/list.ts
 init_agents();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
 async function list(options) {
@@ -3141,7 +3359,11 @@ function getWebAppUrl(registryUrl) {
   }
   try {
     const url = new URL$1(registryUrl);
-    return `${url.protocol}//${url.host}`;
+    let host = url.host;
+    if (host.startsWith("registry.")) {
+      host = host.slice("registry.".length);
+    }
+    return `${url.protocol}//${host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
   }
@@ -3149,7 +3371,11 @@ function getWebAppUrl(registryUrl) {
 function getServerUrl(registryUrl) {
   try {
     const url = new URL$1(registryUrl);
-    return `${url.protocol}//${url.host}`;
+    let host = url.host;
+    if (host.startsWith("registry.")) {
+      host = host.slice("registry.".length);
+    }
+    return `${url.protocol}//${host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
   }
@@ -3175,8 +3401,8 @@ function startCallbackServer(expectedState) {
     let resolveToken;
     let rejectToken;
     let timeoutId;
-    const tokenPromise = new Promise((resolve, reject) => {
-      resolveToken = resolve;
+    const tokenPromise = new Promise((resolve2, reject) => {
+      resolveToken = resolve2;
       rejectToken = reject;
     });
     const server = http.createServer((req, res) => {
@@ -3330,7 +3556,7 @@ async function logout() {
 
 // src/commands/migrate.ts
 init_config();
-init_lockfile();
+init_lockfile2();
 async function migrate(options) {
   try {
     const legacySkillsDir = getLegacySkillsDir();
@@ -3437,6 +3663,19 @@ init_config();
 init_errors();
 init_lib();
 var exec = promisify(exec$1);
+function confirm(question) {
+  return new Promise((resolve2) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.question(`${question} (y/N) `, (answer) => {
+      rl.close();
+      const normalized = answer.trim().toLowerCase();
+      resolve2(normalized === "y" || normalized === "yes");
+    });
+  });
+}
 async function detectManifest() {
   const cwd = process.cwd();
   const pspmJsonPath = join(cwd, "pspm.json");
@@ -3456,7 +3695,8 @@ async function detectManifest() {
       description: packageJson2.description,
       author: typeof packageJson2.author === "string" ? packageJson2.author : packageJson2.author?.name,
       license: packageJson2.license,
-      files: packageJson2.files
+      files: packageJson2.files,
+      dependencies: packageJson2.dependencies
     };
     return { type: "package.json", manifest, path: packageJsonPath };
   } catch {
@@ -3518,15 +3758,31 @@ async function publishCommand(options) {
       console.error(`Error: ${validation.error}`);
       process.exit(1);
     }
+    if (options.access === "public") {
+      console.log("");
+      console.log("\u26A0\uFE0F  Warning: You are about to publish this skill as PUBLIC.");
+      console.log(
+        "   Once a skill is public, it CANNOT be made private again."
+      );
+      console.log("   This action is irreversible.");
+      console.log("");
+      const confirmed = await confirm("Do you want to continue?");
+      if (!confirmed) {
+        console.log("Publish cancelled.");
+        process.exit(0);
+      }
+      console.log("");
+    }
     const packageJson2 = {
       name: manifest.name,
       version: manifest.version,
       description: manifest.description,
-      files: manifest.files
+      files: manifest.files,
+      dependencies: manifest.dependencies
     };
     if (options.bump) {
-      const semver2 = await import('semver');
-      const newVersion = semver2.default.inc(packageJson2.version, options.bump);
+      const semver3 = await import('semver');
+      const newVersion = semver3.default.inc(packageJson2.version, options.bump);
       if (!newVersion) {
         console.error(
           `Error: Failed to bump version from ${packageJson2.version}`
@@ -3587,17 +3843,34 @@ async function publishCommand(options) {
       const shasum = createHash("sha1").update(tarballBuffer).digest("hex");
       const integrityHash = createHash("sha512").update(tarballBuffer).digest("base64");
       const integrity = `sha512-${integrityHash}`;
+      const MAX_TARBALL_SIZE = 10 * 1024 * 1024;
+      if (tarballSize > MAX_TARBALL_SIZE) {
+        console.error("");
+        console.error(
+          `Error: Package size ${formatBytes(tarballSize)} exceeds the maximum allowed size of ${formatBytes(MAX_TARBALL_SIZE)}.`
+        );
+        console.error("");
+        console.error("To reduce the package size:");
+        console.error(
+          '  - Add a "files" field in your manifest to include only necessary files'
+        );
+        console.error("  - Add patterns to .pspmignore to exclude large files");
+        console.error(
+          "  - Remove build artifacts, tests, and documentation from the package"
+        );
+        process.exit(1);
+      }
       console.log("");
       console.log("pspm notice");
       console.log(`pspm notice \u{1F4E6}  ${packageJson2.name}@${packageJson2.version}`);
-      console.log("pspm notice Tarball Contents");
+      console.log("pspm notice === Tarball Contents ===");
       tarballContents.sort((a, b) => b.size - a.size);
       for (const file of tarballContents) {
         console.log(
           `pspm notice ${formatBytes(file.size).padStart(8)} ${file.path}`
         );
       }
-      console.log("pspm notice Tarball Details");
+      console.log("pspm notice === Tarball Details ===");
       console.log(`pspm notice name:          ${packageJson2.name}`);
       console.log(`pspm notice version:       ${packageJson2.version}`);
       console.log(`pspm notice filename:      ${tarballName}`);
@@ -3609,11 +3882,20 @@ async function publishCommand(options) {
       );
       console.log(`pspm notice total files:   ${tarballContents.length}`);
       console.log("pspm notice");
+      const confirmed = await confirm(
+        `Publish ${packageJson2.name}@${packageJson2.version} to ${registryUrl}?`
+      );
+      if (!confirmed) {
+        console.log("Publish cancelled.");
+        process.exit(0);
+      }
+      console.log("");
       console.log(`pspm notice Publishing to ${registryUrl} with tag latest`);
       configure2({ registryUrl, apiKey });
       const response = await publishSkill({
         manifest: packageJson2,
-        tarballBase64
+        tarballBase64,
+        visibility: options.access
       });
       if (response.status !== 200) {
         const errorMessage = extractApiErrorMessage(response, "Publish failed");
@@ -3626,28 +3908,17 @@ async function publishCommand(options) {
         throw new Error(errorMessage);
       }
       const result = response.data;
+      const visibility = result.skill.visibility;
+      const visibilityIcon = visibility === "public" ? "\u{1F310}" : "\u{1F512}";
       console.log(
         `+ @user/${result.skill.username}/${result.skill.name}@${result.version.version}`
       );
       console.log(`Checksum: ${result.version.checksum}`);
-      if (options.access) {
-        console.log(`
-Setting visibility to ${options.access}...`);
-        const accessResponse = await changeSkillAccess(packageJson2.name, {
-          visibility: options.access
-        });
-        if (accessResponse.status !== 200 || !accessResponse.data) {
-          console.warn(
-            `Warning: Failed to set visibility: ${accessResponse.error ?? "Unknown error"}`
-          );
-        } else {
-          console.log(`Package is now ${accessResponse.data.visibility}`);
-          if (options.access === "public") {
-            console.log(
-              "Note: This action is irreversible. Public packages cannot be made private."
-            );
-          }
-        }
+      console.log(`Visibility: ${visibilityIcon} ${visibility}`);
+      if (visibility === "public") {
+        console.log(
+          "Note: Public packages cannot be made private. This is irreversible."
+        );
       }
     } finally {
       await exec(`rm -rf "${tempDir}"`).catch(() => {
@@ -3667,7 +3938,7 @@ Setting visibility to ${options.access}...`);
 init_agents();
 init_config();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
 async function remove(nameOrSpecifier) {
@@ -3837,7 +4108,7 @@ init_api_client();
 init_config();
 init_errors();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_add();
 async function update(options) {
   try {
@@ -3910,6 +4181,52 @@ async function update(options) {
   }
 }
 
+// src/commands/version.ts
+init_manifest2();
+async function version(bump, options = {}) {
+  try {
+    const manifest = await readManifest();
+    if (!manifest) {
+      console.error("Error: No pspm.json found in current directory.");
+      console.error("Run 'pspm init' to create one.");
+      process.exit(1);
+    }
+    if (!manifest.version) {
+      console.error("Error: pspm.json does not have a version field.");
+      console.error(
+        'Add a version field (e.g., "version": "0.1.0") to your pspm.json.'
+      );
+      process.exit(1);
+    }
+    if (!semver__default.valid(manifest.version)) {
+      console.error(
+        `Error: Current version "${manifest.version}" is not valid semver.`
+      );
+      console.error(
+        'Fix the version in pspm.json to be valid semver (e.g., "1.0.0").'
+      );
+      process.exit(1);
+    }
+    const newVersion = semver__default.inc(manifest.version, bump);
+    if (!newVersion) {
+      console.error(`Error: Failed to bump version from ${manifest.version}`);
+      process.exit(1);
+    }
+    if (options.dryRun) {
+      console.log(`Would bump version: ${manifest.version} \u2192 ${newVersion}`);
+      return;
+    }
+    manifest.version = newVersion;
+    await writeManifest(manifest);
+    console.log(`v${newVersion}`);
+    console.log(`Updated ${getManifestPath()}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
+
 // src/commands/whoami.ts
 init_api_client();
 init_config();
@@ -3942,9 +4259,9 @@ var __dirname$1 = dirname(fileURLToPath(import.meta.url));
 var packageJson = JSON.parse(
   readFileSync(join(__dirname$1, "..", "package.json"), "utf-8")
 );
-var version = packageJson.version;
+var version2 = packageJson.version;
 var program = new Command();
-program.name("pspm").description("Prompt Skill Package Manager for AI coding agents").version(version);
+program.name("pspm").description("Prompt Skill Package Manager for AI coding agents").version(version2);
 var configCmd = program.command("config").description("Manage PSPM configuration");
 configCmd.command("show").description("Show resolved configuration").action(async () => {
   await configShow();
@@ -4020,6 +4337,17 @@ program.command("link").description("Recreate agent symlinks without reinstallin
 program.command("update").description("Update all skills to latest compatible versions").option("--dry-run", "Show what would be updated without making changes").action(async (options) => {
   await update({ dryRun: options.dryRun });
 });
+program.command("version <bump>").description("Bump package version (major, minor, patch)").option("--dry-run", "Show what would be changed without writing").action(async (bump, options) => {
+  const validBumps = ["major", "minor", "patch"];
+  if (!validBumps.includes(bump)) {
+    console.error(`Error: Invalid version bump "${bump}".`);
+    console.error("Must be one of: major, minor, patch");
+    process.exit(1);
+  }
+  await version(bump, {
+    dryRun: options.dryRun
+  });
+});
 program.command("publish").description("Publish current directory as a skill").option("--bump <level>", "Bump version (major, minor, patch)").option("--tag <tag>", "Tag for the release").option("--access <level>", "Set package visibility (public or private)").action(async (options) => {
   await publishCommand({
     bump: options.bump,