@anytio/pspm 0.3.2 → 0.4.1

package/CHANGELOG.md

@@ -5,26 +5,94 @@ All notable changes to the PSPM CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.3.0] - 2026-01-27
+## [0.4.1] - 2026-02-09
+
+### Changed
+
+- Updated all outdated dependencies
+
+### Added
+
+- Store SKILL.md content in database and display on package detail page
+
+## [0.4.0] - 2026-02-09
+
+### Added
+
+- **Publish size limit (10MB)**: Packages exceeding 10MB are rejected with actionable suggestions
+  - Client-side validation catches oversized packages before upload
+  - Server-side schema validation updated from 50MB to 10MB
+  - Helpful error messages suggest using `files` field, `.pspmignore`, or removing build artifacts
+
+- **Publish preview with confirmation**: Users now see a full preview before publishing
+  - Displays tarball contents with file sizes (sorted by size)
+  - Shows package size, unpacked size, file count, and integrity hashes
+  - Requires explicit confirmation (`y/N`) before uploading to registry
+
+## [0.3.4] - 2026-01-29
+
+### Added
+
+- **`version` command**: Bump package version in `pspm.json` without publishing (like `npm version`)
+  - `pspm version major` - Bump major version (1.0.0 → 2.0.0)
+  - `pspm version minor` - Bump minor version (1.0.0 → 1.1.0)
+  - `pspm version patch` - Bump patch version (1.0.0 → 1.0.1)
+  - `pspm version patch --dry-run` - Preview changes without writing
+
+- **Visibility support for publish command**: Set package visibility during publish
+  - `pspm publish --access public` - Publish and make public in one step
+  - `pspm publish --access private` - Explicitly publish as private
+
+- **Dependency visibility in publish**: Published packages now include their dependencies in the manifest
+
+### Fixed
+
+- **Registry subdomain compatibility**: SDK now correctly handles registry URLs with subdomains
+- **Improved CLI error messages**: Better extraction and display of API error details
+
+## [0.3.3] - 2026-01-28
+
+### Fixed
+
+- Strip registry subdomain for web app and server URLs
+
+## [0.3.2] - 2026-01-28
 
 ### Added
 
-- **Local directory support**: Install skills directly from local directories using the `file:` protocol
-  - `pspm add file:../my-skill` - Install from relative path
-  - `pspm add file:/absolute/path/to/skill` - Install from absolute path
-  - `pspm add ../my-skill` - Auto-detected as `file:../my-skill`
-  - Local packages are symlinked (not copied) for instant updates during development
-  - `localDependencies` section in `pspm.json`
-  - `localPackages` section in lockfile (version 5)
-  - Local packages stored as symlinks in `.pspm/skills/_local/{name}/`
+- Registry subdomain support for multi-tenant deployments
 
-- **Enhanced `list` command**: Shows local packages with `[local]` indicator and path
+## [0.3.1] - 2026-01-27
 
 ### Changed
 
-- Lockfile version bumped to 5 to support `localPackages`
-- `install` command now processes local dependencies (Phase 2.5 resolve, Phase 4.5 install)
-- `remove` command now handles local package removal
+- Version bump for npm publish
+
+## [0.3.0] - 2026-01-27
+
+### Added
+
+- **`.pspmignore` support for publish command**: Control which files are excluded when publishing or packing skill packages
+  - If `.pspmignore` exists, use it for ignore patterns (like `.npmignore`)
+  - Otherwise, fall back to `.gitignore` if present
+  - Always ignores `node_modules`, `.git`, and `.pspm-publish` regardless
+  - Displays which ignore file is being used during publish
+
+- **Local directory support (file: protocol)**: Install skills from local directories for development and testing
+  - `pspm add file:../path/to/skill` - Install from local directory
+  - `pspm add ../my-skill` - Also works without the `file:` prefix
+  - Creates symlinks in `.pspm/skills/_local/{name}` for instant updates
+  - `localDependencies` field in `pspm.json` for local packages
+  - `localPackages` in lockfile (v4) tracks installed local packages
+  - Validates that directory exists and contains SKILL.md or pspm.json
+  - Provides helpful error messages: "Directory not found", "Not a valid skill directory"
+
+### Fixed
+
+- **Improved error messages for `access` command**: Now provides specific feedback for different specifier types
+  - GitHub specifiers explain that visibility only applies to registry packages
+  - Local file specifiers explain they are not registry packages
+  - Invalid registry specifiers show examples of correct format
 
 ## [0.2.0] - 2026-01-23
 

package/CLI_GUIDE.md

@@ -36,6 +36,7 @@ Commands:
   install|i [options] [specifiers...]        Install skills from lockfile, or add and install specific packages
   link [options]                             Recreate agent symlinks without reinstalling
   update [options]                           Update all skills to latest compatible versions
+  version <bump>                             Bump package version (major, minor, patch)
   publish [options]                          Publish current directory as a skill
   unpublish [options] <specifier>            Remove a published skill version (only within 72 hours of publishing)
   access [options] [specifier]               Change package visibility (public/private)
@@ -77,7 +78,7 @@ pspm whoami
 # Output:
 #   Username: myuser
 #   User ID: user_123
-#   Registry: https://pspm.dev
+#   Registry: https://registry.pspm.dev
 ```
 
 ## Configuration
@@ -92,7 +93,7 @@ pspm config show
 # Output:
 #   Resolved Configuration:
 #
-#     Registry URL:   https://pspm.dev
+#     Registry URL:   https://registry.pspm.dev
 #     API Key:        ***
 #     Username:       myuser
 #
@@ -158,10 +159,10 @@ pspm add github:owner/repo@main             # Entire repo, specific branch
 pspm add github:owner/repo/path/to/skill    # Subdirectory, default branch
 pspm add github:owner/repo/path@v1.0.0      # Subdirectory with tag/ref
 
-# Local specifier formats:
-pspm add file:../my-skill                   # Relative path (symlinked)
+# Local directory specifiers (for development):
+pspm add file:../my-skill                   # Relative path
+pspm add file:./local-skill                 # Current directory relative
 pspm add file:/absolute/path/to/skill       # Absolute path
-pspm add ../my-skill                        # Auto-detected as file:../my-skill
 
 # Add multiple skills at once:
 pspm add @user/alice/skill1 @user/bob/skill2
@@ -201,10 +202,7 @@ pspm list --json
 #   github:owner/repo/skills/react-tips (main@abc1234)
 #     -> .claude/skills/react-tips, .cursor/skills/react-tips
 #
-#   my-local-skill [local] <- ../my-local-skill
-#     -> .claude/skills/my-local-skill
-#
-# Total: 3 skill(s) (1 registry, 1 github, 1 local)
+# Total: 2 skill(s) (1 registry, 1 github)
 ```
 
 ### Install Skills
@@ -243,6 +241,30 @@ pspm update
 pspm update --dry-run    # Preview updates without applying
 ```
 
+## Versioning
+
+### Bump Version
+
+Bump the package version in `pspm.json` without publishing (similar to `npm version`):
+
+```bash
+pspm version <bump>
+
+# Bump types:
+pspm version major      # 1.0.0 → 2.0.0
+pspm version minor      # 1.0.0 → 1.1.0
+pspm version patch      # 1.0.0 → 1.0.1
+
+# Options:
+pspm version patch --dry-run   # Preview what would change
+```
+
+The command:
+- Reads the current version from `pspm.json`
+- Increments the version according to semver rules
+- Writes the updated version back to `pspm.json`
+- Outputs the new version (e.g., `v1.0.1`)
+
 ## Publishing
 
 ### Publish Skill
@@ -321,7 +343,7 @@ INI format configuration file:
 ```ini
 ; PSPM Configuration
 
-registry = https://pspm.dev
+registry = https://registry.pspm.dev
 authToken = sk_...
 username = myuser
 
@@ -353,7 +375,16 @@ Package manifest file (created with `pspm init`):
   "version": "1.0.0",
   "description": "A helpful skill for...",
   "author": "Your Name",
-  "files": ["pspm.json", "SKILL.md", "runtime", "scripts", "data"]
+  "files": ["pspm.json", "SKILL.md", "runtime", "scripts", "data"],
+  "dependencies": {
+    "@user/other/skill": "^1.0.0"
+  },
+  "githubDependencies": {
+    "github:owner/repo/skills/example": "main"
+  },
+  "localDependencies": {
+    "file:../my-local-skill": "*"
+  }
 }
 ```
 
@@ -361,12 +392,12 @@ Package manifest file (created with `pspm init`):
 
 ```json
 {
-  "lockfileVersion": 5,
-  "registryUrl": "https://pspm.dev",
+  "lockfileVersion": 4,
+  "registryUrl": "https://registry.pspm.dev",
   "packages": {
     "@user/bsheng/vite_slides": {
       "version": "2.0.0",
-      "resolved": "https://pspm.dev/...",
+      "resolved": "https://registry.pspm.dev/...",
       "integrity": "sha256-abc123..."
     }
   },
@@ -380,11 +411,11 @@ Package manifest file (created with `pspm init`):
     }
   },
   "localPackages": {
-    "file:../my-skill": {
+    "file:../my-local-skill": {
       "version": "local",
-      "path": "../my-skill",
-      "resolvedPath": "/absolute/path/to/my-skill",
-      "name": "my-skill"
+      "path": "../my-local-skill",
+      "resolvedPath": "/absolute/path/to/my-local-skill",
+      "name": "my-local-skill"
     }
   }
 }
@@ -422,8 +453,8 @@ project/
 │   │   │   └── {owner}/
 │   │   │       └── {repo}/
 │   │   │           └── {path}/
-│   │   └── _local/      # Local skills (symlinks)
-│   │       └── {name} -> /path/to/source
+│   │   └── _local/      # Local skill symlinks
+│   │       └── {name} -> ../../../path/to/local/skill
 │   └── cache/           # Tarball cache
 ├── .claude/
 │   └── skills/          # Symlinks for claude-code agent
@@ -446,6 +477,31 @@ export PSPM_API_KEY=sk_ci_key
 pspm install --frozen-lockfile
 ```
 
+### Local Development Workflow
+
+Use local dependencies to develop and test skills before publishing:
+
+```bash
+# Add a local skill for development
+pspm add file:../my-skill
+
+# The skill is symlinked, so changes are instant
+# No need to reinstall after editing the local skill
+
+# When ready to publish
+cd ../my-skill
+pspm publish
+```
+
+In your `pspm.json`:
+```json
+{
+  "localDependencies": {
+    "file:../my-local-skill": "*"
+  }
+}
+```
+
 ### Publishing Workflow
 
 ```bash

package/README.md

@@ -100,10 +100,9 @@ pspm install                                     # Install all from lockfile
 - `github:owner/repo/path/to/skill` - Subdirectory within repo
 - `github:owner/repo/path/to/skill@v1.0.0` - Subdirectory with tag
 
-**Local specifier formats:**
-- `file:../my-skill` - Relative path (symlinked, not copied)
-- `file:/absolute/path/to/skill` - Absolute path
-- `../my-skill` - Auto-detected as `file:../my-skill`
+**Local directory specifiers (for development):**
+- `file:../path/to/skill` - Install from local directory
+- `file:./subdir/skill` - Relative path from current directory
 
 **Agent symlink options:**
 ```bash
@@ -114,6 +113,15 @@ pspm link --agent codex                          # Recreate symlinks for specifi
 
 Default is all agents (`claude-code`, `codex`, `cursor`, `gemini`, `kiro`, `opencode`). Use `--agent claude-code` to install for a single agent.
 
+### Versioning
+
+```bash
+pspm version major            # Bump major version (1.0.0 → 2.0.0)
+pspm version minor            # Bump minor version (1.0.0 → 1.1.0)
+pspm version patch            # Bump patch version (1.0.0 → 1.0.1)
+pspm version patch --dry-run  # Preview changes without writing
+```
+
 ### Publishing
 
 ```bash
@@ -124,6 +132,9 @@ pspm unpublish <spec> --force # Remove a published skill version
 pspm deprecate <spec> [msg]   # Mark a version as deprecated
 ```
 
+**Publish preview:** Before uploading, `pspm publish` shows a preview of included files, package size, and requires confirmation. Max package size is **10MB**.
+
+
 ### Visibility
 
 ```bash
@@ -148,7 +159,7 @@ PSPM uses a simple npm-like INI configuration format.
 
 ```ini
 ; PSPM Configuration
-registry = https://pspm.dev
+registry = https://registry.pspm.dev
 authToken = sk_...
 username = myuser
 ```
@@ -166,12 +177,12 @@ registry = https://custom-registry.example.com
 
 ```json
 {
-  "lockfileVersion": 5,
-  "registryUrl": "https://pspm.dev",
+  "lockfileVersion": 4,
+  "registryUrl": "https://registry.pspm.dev",
   "packages": {
     "@user/username/skillname": {
       "version": "1.0.0",
-      "resolved": "https://pspm.dev/...",
+      "resolved": "https://registry.pspm.dev/@user/username/skillname/1.0.0",
       "integrity": "sha256-..."
     }
   },
@@ -185,11 +196,11 @@ registry = https://custom-registry.example.com
     }
   },
   "localPackages": {
-    "file:../my-skill": {
+    "file:../my-local-skill": {
       "version": "local",
-      "path": "../my-skill",
-      "resolvedPath": "/absolute/path/to/my-skill",
-      "name": "my-skill"
+      "path": "../my-local-skill",
+      "resolvedPath": "/absolute/path/to/my-local-skill",
+      "name": "my-local-skill"
     }
   }
 }
@@ -220,8 +231,8 @@ project/
 │   │   │       └── repo/
 │   │   │           └── path/
 │   │   │               └── SKILL.md
-│   │   └── _local/      # Local skills (symlinks)
-│   │       └── my-skill -> /absolute/path/to/my-skill
+│   │   └── _local/      # Local skill symlinks
+│   │       └── skillname -> ../../../path/to/local/skill
 │   └── cache/           # Tarball cache
 ├── .claude/
 │   └── skills/          # Symlinks for claude-code agent
@@ -234,6 +245,23 @@ project/
 └── .pspmrc              # User config
 ```
 
+## Ignoring Files (.pspmignore)
+
+Control which files are excluded when publishing with a `.pspmignore` file:
+
+```
+# .pspmignore - exclude files from publish
+*.test.ts
+__tests__/
+.env*
+*.log
+```
+
+**Behavior:**
+- If `.pspmignore` exists, use it for ignore patterns
+- Otherwise, fall back to `.gitignore` if present
+- Always ignores `node_modules`, `.git`, and `.pspm-publish` regardless
+
 ## Creating a Skill
 
 A skill is a directory containing at minimum a `pspm.json` and `SKILL.md`: