@anytio/pspm 0.3.2 → 0.4.1

package/dist/index.js

@@ -1,4 +1,22 @@
 #!/usr/bin/env node
+import { stat, writeFile, readdir, mkdir, rm, rename, access as access$1, readFile, symlink, lstat, unlink, cp, readlink } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, join, basename, resolve, relative } from 'path';
+import * as ini from 'ini';
+import ignore from 'ignore';
+import { createHash, randomBytes } from 'crypto';
+import * as semver from 'semver';
+import semver__default from 'semver';
+import { checkbox } from '@inquirer/prompts';
+import { readFileSync } from 'fs';
+import { fileURLToPath, URL as URL$1 } from 'url';
+import { Command } from 'commander';
+import { createInterface } from 'readline';
+import http from 'http';
+import open from 'open';
+import { exec as exec$1 } from 'child_process';
+import { promisify } from 'util';
+
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -51,7 +69,6 @@ async function customFetch(url, options) {
 var config;
 var init_fetcher = __esm({
   "src/sdk/fetcher.ts"() {
-    "use strict";
     config = null;
   }
 });
@@ -60,7 +77,6 @@ var init_fetcher = __esm({
 var getMeUrl, me, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getPublishSkillUrl, publishSkill, getDeleteSkillUrl, deleteSkill, getDeleteSkillVersionUrl, deleteSkillVersion;
 var init_generated = __esm({
   "src/sdk/generated/index.ts"() {
-    "use strict";
     init_fetcher();
     getMeUrl = () => {
       return `/api/skills/me`;
@@ -86,12 +102,12 @@ var init_generated = __esm({
         }
       );
     };
-    getGetSkillVersionUrl = (username, name, version2) => {
-      return `/api/skills/@user/${username}/${name}/${version2}`;
+    getGetSkillVersionUrl = (username, name, version3) => {
+      return `/api/skills/@user/${username}/${name}/${version3}`;
     };
-    getSkillVersion = async (username, name, version2, options) => {
+    getSkillVersion = async (username, name, version3, options) => {
       return customFetch(
-        getGetSkillVersionUrl(username, name, version2),
+        getGetSkillVersionUrl(username, name, version3),
         {
           ...options,
           method: "GET"
@@ -126,12 +142,12 @@ var init_generated = __esm({
         }
       );
     };
-    getDeleteSkillVersionUrl = (name, version2) => {
-      return `/api/skills/${name}/${version2}`;
+    getDeleteSkillVersionUrl = (name, version3) => {
+      return `/api/skills/${name}/${version3}`;
     };
-    deleteSkillVersion = async (name, version2, options) => {
+    deleteSkillVersion = async (name, version3, options) => {
       return customFetch(
-        getDeleteSkillVersionUrl(name, version2),
+        getDeleteSkillVersionUrl(name, version3),
         {
           ...options,
           method: "DELETE"
@@ -165,14 +181,14 @@ async function whoamiRequest(registryUrl, apiKey) {
     return null;
   }
 }
-async function deprecateSkillVersion(skillName, version2, message) {
+async function deprecateSkillVersion(skillName, version3, message) {
   const config2 = getConfig();
   if (!config2) {
     return { status: 401, error: "SDK not configured" };
   }
   try {
     const response = await fetch(
-      `${config2.baseUrl}/api/skills/${skillName}/${version2}/deprecate`,
+      `${config2.baseUrl}/api/skills/${skillName}/${version3}/deprecate`,
       {
         method: "POST",
         headers: {
@@ -195,14 +211,14 @@ async function deprecateSkillVersion(skillName, version2, message) {
     };
   }
 }
-async function undeprecateSkillVersion(skillName, version2) {
+async function undeprecateSkillVersion(skillName, version3) {
   const config2 = getConfig();
   if (!config2) {
     return { status: 401, error: "SDK not configured" };
   }
   try {
     const response = await fetch(
-      `${config2.baseUrl}/api/skills/${skillName}/${version2}/deprecate`,
+      `${config2.baseUrl}/api/skills/${skillName}/${version3}/deprecate`,
       {
         method: "DELETE",
         headers: {
@@ -263,13 +279,27 @@ async function changeSkillAccess(skillName, input) {
 }
 var init_api_client = __esm({
   "src/api-client.ts"() {
-    "use strict";
     init_fetcher();
     init_generated();
   }
 });
 
 // src/errors.ts
+function getHttpStatusDescription(status) {
+  const descriptions = {
+    400: "Bad Request - The request was malformed",
+    401: "Unauthorized - Please run 'pspm login' first",
+    403: "Forbidden - You don't have permission for this action",
+    404: "Not Found - The endpoint or resource doesn't exist",
+    409: "Conflict - The resource already exists or there's a version conflict",
+    422: "Validation Error - The request data is invalid",
+    429: "Too Many Requests - Please slow down and try again",
+    500: "Internal Server Error - Something went wrong on the server",
+    502: "Bad Gateway - The server is temporarily unavailable",
+    503: "Service Unavailable - The server is temporarily unavailable"
+  };
+  return descriptions[status] || `HTTP Error ${status}`;
+}
 function extractApiErrorMessage(response, fallbackMessage) {
   const errorData = response.data;
   if (process.env.PSPM_DEBUG) {
@@ -279,8 +309,20 @@ function extractApiErrorMessage(response, fallbackMessage) {
       JSON.stringify(errorData, null, 2)
     );
   }
-  if (!errorData) {
-    return `${fallbackMessage} (HTTP ${response.status})`;
+  if (typeof errorData === "string") {
+    if (response.status === 404) {
+      return `${fallbackMessage}: ${getHttpStatusDescription(404)}
+The registry endpoint may be unavailable or misconfigured.`;
+    }
+    return `${fallbackMessage}: ${errorData} (HTTP ${response.status})`;
+  }
+  if (!errorData || typeof errorData !== "object") {
+    const statusDesc = getHttpStatusDescription(response.status);
+    if (response.status === 404) {
+      return `${fallbackMessage}: ${statusDesc}
+Check that the registry URL is correct in your config.`;
+    }
+    return `${fallbackMessage}: ${statusDesc}`;
   }
   let errorMessage = errorData.message || fallbackMessage;
   if (errorData.code === "VALIDATION_ERROR" && errorData.details) {
@@ -298,6 +340,9 @@ ${issueMessages}`;
   if (errorData.code && !errorMessage.includes(errorData.code)) {
     errorMessage = `[${errorData.code}] ${errorMessage}`;
   }
+  if (response.status >= 400) {
+    errorMessage += ` (HTTP ${response.status})`;
+  }
   if (errorData.requestId) {
     errorMessage += `
 (Request ID: ${errorData.requestId})`;
@@ -307,7 +352,6 @@ ${issueMessages}`;
 var ConfigError, NotLoggedInError;
 var init_errors = __esm({
   "src/errors.ts"() {
-    "use strict";
     ConfigError = class extends Error {
       constructor(message) {
         super(message);
@@ -324,12 +368,6 @@ var init_errors = __esm({
     };
   }
 });
-
-// src/config.ts
-import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
-import * as ini from "ini";
 function getConfigPath() {
   return join(homedir(), ".pspmrc");
 }
@@ -602,106 +640,63 @@ async function getRegistryUrl() {
 var DEFAULT_REGISTRY_URL;
 var init_config = __esm({
   "src/config.ts"() {
-    "use strict";
     init_errors();
-    DEFAULT_REGISTRY_URL = "https://pspm.dev";
+    DEFAULT_REGISTRY_URL = "https://registry.pspm.dev";
+  }
+});
+async function loadIgnorePatterns(cwd = process.cwd()) {
+  const ig = ignore();
+  ig.add(ALWAYS_IGNORED);
+  const pspmIgnorePath = join(cwd, ".pspmignore");
+  try {
+    const content = await readFile(pspmIgnorePath, "utf-8");
+    const patterns = parseIgnorePatterns(content);
+    ig.add(patterns);
+    return { ig, source: ".pspmignore", patterns };
+  } catch {
+  }
+  const gitIgnorePath = join(cwd, ".gitignore");
+  try {
+    const content = await readFile(gitIgnorePath, "utf-8");
+    const patterns = parseIgnorePatterns(content);
+    ig.add(patterns);
+    return { ig, source: ".gitignore", patterns };
+  } catch {
+  }
+  return { ig, source: null, patterns: [] };
+}
+function getExcludeArgsForRsync(patterns) {
+  const allPatterns = [.../* @__PURE__ */ new Set([...ALWAYS_IGNORED, ...patterns])];
+  return allPatterns.map((p) => `--exclude='${p}'`).join(" ");
+}
+function parseIgnorePatterns(content) {
+  return content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
+}
+var ALWAYS_IGNORED;
+var init_ignore = __esm({
+  "src/lib/ignore.ts"() {
+    ALWAYS_IGNORED = [
+      "node_modules",
+      ".git",
+      ".pspm-publish"
+      // temp directory used during publish
+    ];
   }
 });
-
-// src/lib/integrity.ts
-import { createHash } from "crypto";
 function calculateIntegrity(data) {
   const hash = createHash("sha256").update(data).digest("base64");
   return `sha256-${hash}`;
 }
 var init_integrity = __esm({
   "src/lib/integrity.ts"() {
-    "use strict";
   }
 });
 
-// src/lib/local.ts
-import { access, stat as stat2 } from "fs/promises";
-import { isAbsolute, join as join2, resolve } from "path";
-function isLocalSpecifier(specifier) {
-  return specifier.startsWith("file:");
-}
-function isBareLocalPath(specifier) {
-  return specifier.startsWith("./") || specifier.startsWith("../");
-}
-function parseLocalSpecifier(specifier) {
-  const match = specifier.match(LOCAL_SPECIFIER_PATTERN);
-  if (!match) {
-    return null;
-  }
-  const path = match[1];
-  if (!path || path.trim() === "") {
-    return null;
-  }
-  return {
-    path,
-    isAbsolute: isAbsolute(path)
-  };
-}
-function getLocalSkillName(spec) {
-  const normalizedPath = spec.path.replace(/\/+$/, "");
-  const segments = normalizedPath.split("/").filter(Boolean);
-  return segments[segments.length - 1] || spec.path;
-}
-function normalizeToFileSpecifier(path) {
-  if (isLocalSpecifier(path)) {
-    return path;
-  }
-  return `file:${path}`;
-}
-function resolveLocalPath(spec, basePath = process.cwd()) {
-  if (spec.isAbsolute) {
-    return resolve(spec.path);
-  }
-  return resolve(basePath, spec.path);
-}
-async function validateLocalSkill(absolutePath) {
-  try {
-    const stats = await stat2(absolutePath);
-    if (!stats.isDirectory()) {
-      return { valid: false, error: `Not a directory: ${absolutePath}` };
-    }
-  } catch {
-    return { valid: false, error: `Directory not found: ${absolutePath}` };
-  }
-  const manifestPath = join2(absolutePath, "pspm.json");
-  try {
-    await access(manifestPath);
-  } catch {
-    return {
-      valid: false,
-      error: `No pspm.json found in ${absolutePath}`
-    };
-  }
-  try {
-    const { readFile: readFile7 } = await import("fs/promises");
-    const content = await readFile7(manifestPath, "utf-8");
-    const manifest = JSON.parse(content);
-    if (!manifest.name) {
-      return {
-        valid: false,
-        error: `Manifest in ${absolutePath} is missing 'name' field`
-      };
-    }
-    return { valid: true, manifest };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      valid: false,
-      error: `Failed to read manifest in ${absolutePath}: ${message}`
-    };
-  }
-}
-var LOCAL_SPECIFIER_PATTERN;
-var init_local = __esm({
-  "src/lib/local.ts"() {
-    "use strict";
-    LOCAL_SPECIFIER_PATTERN = /^file:(.+)$/;
+// src/lib/lockfile.ts
+var PSPM_LOCKFILE_SCHEMA_URL;
+var init_lockfile = __esm({
+  "src/lib/lockfile.ts"() {
+    PSPM_LOCKFILE_SCHEMA_URL = "https://pspm.dev/schema/v1/pspm-lock.json";
   }
 });
 
@@ -730,7 +725,6 @@ function validateManifest(manifest) {
 var DEFAULT_SKILL_FILES, PSPM_SCHEMA_URL;
 var init_manifest = __esm({
   "src/lib/manifest.ts"() {
-    "use strict";
     DEFAULT_SKILL_FILES = [
       "SKILL.md",
       "runtime",
@@ -740,9 +734,6 @@ var init_manifest = __esm({
     PSPM_SCHEMA_URL = "https://pspm.dev/schema/v1/pspm.json";
   }
 });
-
-// src/lib/version.ts
-import * as semver from "semver";
 function resolveVersion(range, availableVersions) {
   const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
   if (!range || range === "latest" || range === "*") {
@@ -756,19 +747,18 @@ function findHighestSatisfying(ranges, availableVersions) {
   const normalizedRanges = ranges.map(
     (r) => !r || r === "latest" || r === "*" ? "*" : r
   );
-  for (const version2 of sorted) {
+  for (const version3 of sorted) {
     const satisfiesAll = normalizedRanges.every(
-      (range) => semver.satisfies(version2, range)
+      (range) => semver.satisfies(version3, range)
     );
     if (satisfiesAll) {
-      return version2;
+      return version3;
     }
   }
   return null;
 }
 var init_version = __esm({
   "src/lib/version.ts"() {
-    "use strict";
   }
 });
 
@@ -1077,7 +1067,6 @@ function printResolutionErrors(errors, conflicts = []) {
 var MAX_DEPENDENCY_DEPTH;
 var init_resolver = __esm({
   "src/lib/resolver.ts"() {
-    "use strict";
     init_api_client();
     init_version();
     MAX_DEPENDENCY_DEPTH = 5;
@@ -1090,9 +1079,14 @@ function parseSkillSpecifier(specifier) {
   if (!match) {
     return null;
   }
+  const username = match[1];
+  const name = match[2];
+  if (!username || !name) {
+    return null;
+  }
   return {
-    username: match[1],
-    name: match[2],
+    username,
+    name,
     versionRange: match[3]
   };
 }
@@ -1102,6 +1096,9 @@ function parseGitHubSpecifier(specifier) {
     return null;
   }
   const [, owner, repo, pathWithSlash, ref] = match;
+  if (!owner || !repo) {
+    return null;
+  }
   return {
     owner,
     repo,
@@ -1123,7 +1120,10 @@ function formatGitHubSpecifier(spec) {
 function getGitHubSkillName(spec) {
   if (spec.path) {
     const segments = spec.path.split("/").filter(Boolean);
-    return segments[segments.length - 1];
+    const lastSegment = segments[segments.length - 1];
+    if (lastSegment) {
+      return lastSegment;
+    }
   }
   return spec.repo;
 }
@@ -1133,7 +1133,6 @@ function isGitHubSpecifier(specifier) {
 var SPECIFIER_PATTERN, GITHUB_SPECIFIER_PATTERN;
 var init_specifier = __esm({
   "src/lib/specifier.ts"() {
-    "use strict";
     SPECIFIER_PATTERN = /^@user\/([a-zA-Z0-9_-]+)\/([a-z][a-z0-9_-]*)(?:@(.+))?$/;
     GITHUB_SPECIFIER_PATTERN = /^github:([a-zA-Z0-9_-]+)\/([a-zA-Z0-9_.-]+)(\/[^@]+)?(?:@(.+))?$/;
   }
@@ -1142,18 +1141,15 @@ var init_specifier = __esm({
 // src/lib/index.ts
 var init_lib = __esm({
   "src/lib/index.ts"() {
-    "use strict";
+    init_ignore();
     init_integrity();
-    init_local();
+    init_lockfile();
     init_manifest();
     init_resolver();
     init_specifier();
     init_version();
   }
 });
-
-// src/agents.ts
-import { checkbox } from "@inquirer/prompts";
 function resolveAgentConfig(name, overrides) {
   if (overrides?.[name]) {
     return overrides[name];
@@ -1196,7 +1192,6 @@ async function promptForAgents() {
 var AGENT_INFO, DEFAULT_AGENT_CONFIGS, ALL_AGENTS;
 var init_agents = __esm({
   "src/agents.ts"() {
-    "use strict";
     AGENT_INFO = {
       "claude-code": {
         displayName: "Claude Code",
@@ -1241,10 +1236,6 @@ var init_agents = __esm({
     ];
   }
 });
-
-// src/github.ts
-import { cp, lstat, mkdir as mkdir2, readdir, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join3 } from "path";
 function getGitHubHeaders() {
   const headers = {
     Accept: "application/vnd.github+json",
@@ -1320,14 +1311,14 @@ async function downloadGitHubPackage(spec) {
   return { buffer, commit, integrity };
 }
 async function extractGitHubPackage(spec, buffer, skillsDir) {
-  const destPath = spec.path ? join3(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join3(skillsDir, "_github", spec.owner, spec.repo);
-  const tempDir = join3(skillsDir, "_github", ".temp", `${Date.now()}`);
-  await mkdir2(tempDir, { recursive: true });
-  const tempFile = join3(tempDir, "archive.tgz");
+  const destPath = spec.path ? join(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join(skillsDir, "_github", spec.owner, spec.repo);
+  const tempDir = join(skillsDir, "_github", ".temp", `${Date.now()}`);
+  await mkdir(tempDir, { recursive: true });
+  const tempFile = join(tempDir, "archive.tgz");
   try {
-    await writeFile2(tempFile, buffer);
-    const { exec: exec2 } = await import("child_process");
-    const { promisify: promisify2 } = await import("util");
+    await writeFile(tempFile, buffer);
+    const { exec: exec2 } = await import('child_process');
+    const { promisify: promisify2 } = await import('util');
     const execAsync = promisify2(exec2);
     await execAsync(`tar -xzf "${tempFile}" -C "${tempDir}"`);
     const entries = await readdir(tempDir);
@@ -1337,15 +1328,15 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
     if (!extractedDir) {
       throw new Error("Failed to find extracted directory in tarball");
     }
-    const sourcePath = join3(tempDir, extractedDir);
-    const copySource = spec.path ? join3(sourcePath, spec.path) : sourcePath;
+    const sourcePath = join(tempDir, extractedDir);
+    const copySource = spec.path ? join(sourcePath, spec.path) : sourcePath;
     if (spec.path) {
       const pathExists = await lstat(copySource).catch(() => null);
       if (!pathExists) {
         const rootEntries = await readdir(sourcePath);
         const dirs = [];
         for (const entry of rootEntries) {
-          const stat8 = await lstat(join3(sourcePath, entry)).catch(() => null);
+          const stat8 = await lstat(join(sourcePath, entry)).catch(() => null);
           if (stat8?.isDirectory() && !entry.startsWith(".")) {
             dirs.push(entry);
           }
@@ -1354,7 +1345,7 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
       }
     }
     await rm(destPath, { recursive: true, force: true });
-    await mkdir2(destPath, { recursive: true });
+    await mkdir(destPath, { recursive: true });
     await cp(copySource, destPath, { recursive: true });
     return spec.path ? `.pspm/skills/_github/${spec.owner}/${spec.repo}/${spec.path}` : `.pspm/skills/_github/${spec.owner}/${spec.repo}`;
   } finally {
@@ -1368,15 +1359,13 @@ function getGitHubDisplayName(spec, commit) {
   }
   if (spec.ref || commit) {
     const ref = spec.ref || "HEAD";
-    const shortCommit = commit ? commit.slice(0, 7) : "";
-    name += ` (${ref}${shortCommit ? `@${shortCommit}` : ""})`;
+    name += ` (${ref}${""})`;
   }
   return name;
 }
 var GitHubRateLimitError, GitHubNotFoundError, GitHubPathNotFoundError;
 var init_github = __esm({
   "src/github.ts"() {
-    "use strict";
     init_lib();
     GitHubRateLimitError = class extends Error {
       constructor() {
@@ -1409,13 +1398,9 @@ Available paths in repository root:
     };
   }
 });
-
-// src/lockfile.ts
-import { mkdir as mkdir3, readFile as readFile2, stat as stat3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname2 } from "path";
 async function hasLegacyLockfile() {
   try {
-    await stat3(getLegacyLockfilePath());
+    await stat(getLegacyLockfilePath());
     return true;
   } catch {
     return false;
@@ -1425,24 +1410,24 @@ async function migrateLockfileIfNeeded() {
   const legacyPath = getLegacyLockfilePath();
   const newPath = getLockfilePath();
   try {
-    await stat3(legacyPath);
+    await stat(legacyPath);
   } catch {
     return false;
   }
   try {
-    await stat3(newPath);
+    await stat(newPath);
     return false;
   } catch {
   }
   try {
-    const content = await readFile2(legacyPath, "utf-8");
+    const content = await readFile(legacyPath, "utf-8");
     const oldLockfile = JSON.parse(content);
     const newLockfile = {
       lockfileVersion: 2,
       registryUrl: oldLockfile.registryUrl,
       packages: oldLockfile.skills ?? {}
     };
-    await writeFile3(newPath, `${JSON.stringify(newLockfile, null, 2)}
+    await writeFile(newPath, `${JSON.stringify(newLockfile, null, 2)}
 `);
     console.log("Migrated lockfile: skill-lock.json \u2192 pspm-lock.json");
     return true;
@@ -1453,7 +1438,7 @@ async function migrateLockfileIfNeeded() {
 async function readLockfile() {
   const lockfilePath = getLockfilePath();
   try {
-    const content = await readFile2(lockfilePath, "utf-8");
+    const content = await readFile(lockfilePath, "utf-8");
     const lockfile = JSON.parse(content);
     if (lockfile.lockfileVersion === 1 && lockfile.skills && !lockfile.packages) {
       return {
@@ -1466,7 +1451,7 @@ async function readLockfile() {
   } catch {
     if (await hasLegacyLockfile()) {
       try {
-        const content = await readFile2(getLegacyLockfilePath(), "utf-8");
+        const content = await readFile(getLegacyLockfilePath(), "utf-8");
         const legacyLockfile = JSON.parse(content);
         return {
           lockfileVersion: 2,
@@ -1482,30 +1467,25 @@ async function readLockfile() {
 }
 async function writeLockfile(lockfile) {
   const lockfilePath = getLockfilePath();
-  await mkdir3(dirname2(lockfilePath), { recursive: true });
+  await mkdir(dirname(lockfilePath), { recursive: true });
   const packages = lockfile.packages ?? lockfile.skills ?? {};
   const hasDependencies = Object.values(packages).some(
     (pkg) => pkg.dependencies && Object.keys(pkg.dependencies).length > 0
   );
-  const hasLocalPackages = lockfile.localPackages && Object.keys(lockfile.localPackages).length > 0;
-  let version2 = 3;
-  if (hasLocalPackages) {
-    version2 = 5;
-  } else if (hasDependencies) {
-    version2 = 4;
-  }
+  const version3 = hasDependencies ? 4 : 3;
   const normalized = {
-    lockfileVersion: version2,
+    $schema: PSPM_LOCKFILE_SCHEMA_URL,
+    lockfileVersion: version3,
     registryUrl: lockfile.registryUrl,
     packages
   };
   if (lockfile.githubPackages && Object.keys(lockfile.githubPackages).length > 0) {
     normalized.githubPackages = lockfile.githubPackages;
   }
-  if (hasLocalPackages) {
+  if (lockfile.localPackages && Object.keys(lockfile.localPackages).length > 0) {
     normalized.localPackages = lockfile.localPackages;
   }
-  await writeFile3(lockfilePath, `${JSON.stringify(normalized, null, 2)}
+  await writeFile(lockfilePath, `${JSON.stringify(normalized, null, 2)}
 `);
 }
 async function createEmptyLockfile() {
@@ -1609,41 +1589,18 @@ async function addLocalToLockfile(specifier, entry) {
   lockfile.localPackages[specifier] = entry;
   await writeLockfile(lockfile);
 }
-async function removeLocalFromLockfile(specifier) {
-  const lockfile = await readLockfile();
-  if (!lockfile?.localPackages?.[specifier]) {
-    return false;
-  }
-  delete lockfile.localPackages[specifier];
-  await writeLockfile(lockfile);
-  return true;
-}
-async function listLockfileLocalPackages() {
-  const lockfile = await readLockfile();
-  if (!lockfile?.localPackages) {
-    return [];
-  }
-  return Object.entries(lockfile.localPackages).map(([specifier, entry]) => ({
-    specifier,
-    entry
-  }));
-}
-var init_lockfile = __esm({
+var init_lockfile2 = __esm({
   "src/lockfile.ts"() {
-    "use strict";
     init_config();
+    init_lib();
   }
 });
-
-// src/manifest.ts
-import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import { join as join4 } from "path";
 function getManifestPath() {
-  return join4(process.cwd(), "pspm.json");
+  return join(process.cwd(), "pspm.json");
 }
 async function readManifest() {
   try {
-    const content = await readFile3(getManifestPath(), "utf-8");
+    const content = await readFile(getManifestPath(), "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -1651,7 +1608,7 @@ async function readManifest() {
 }
 async function writeManifest(manifest) {
   const content = JSON.stringify(manifest, null, 2);
-  await writeFile4(getManifestPath(), `${content}
+  await writeFile(getManifestPath(), `${content}
 `);
 }
 async function createMinimalManifest() {
@@ -1709,36 +1666,18 @@ async function removeGitHubDependency(specifier) {
   await writeManifest(manifest);
   return true;
 }
-async function getLocalDependencies() {
-  const manifest = await readManifest();
-  return manifest?.localDependencies ?? {};
-}
-async function addLocalDependency(specifier, version2 = "*") {
+async function addLocalDependency(specifier, version3 = "*") {
   const manifest = await ensureManifest();
   if (!manifest.localDependencies) {
     manifest.localDependencies = {};
   }
-  manifest.localDependencies[specifier] = version2;
+  manifest.localDependencies[specifier] = version3;
   await writeManifest(manifest);
 }
-async function removeLocalDependency(specifier) {
-  const manifest = await readManifest();
-  if (!manifest?.localDependencies?.[specifier]) {
-    return false;
-  }
-  delete manifest.localDependencies[specifier];
-  await writeManifest(manifest);
-  return true;
-}
 var init_manifest2 = __esm({
   "src/manifest.ts"() {
-    "use strict";
   }
 });
-
-// src/symlinks.ts
-import { lstat as lstat2, mkdir as mkdir4, readlink, rm as rm2, symlink } from "fs/promises";
-import { dirname as dirname3, join as join5, relative } from "path";
 async function createAgentSymlinks(skills, options) {
   const { agents, projectRoot, agentConfigs } = options;
   if (agents.length === 1 && agents[0] === "none") {
@@ -1750,26 +1689,26 @@ async function createAgentSymlinks(skills, options) {
       console.warn(`Warning: Unknown agent "${agentName}", skipping symlinks`);
       continue;
     }
-    const agentSkillsDir = join5(projectRoot, config2.skillsDir);
-    await mkdir4(agentSkillsDir, { recursive: true });
+    const agentSkillsDir = join(projectRoot, config2.skillsDir);
+    await mkdir(agentSkillsDir, { recursive: true });
     for (const skill of skills) {
-      const symlinkPath = join5(agentSkillsDir, skill.name);
-      const targetPath = join5(projectRoot, skill.sourcePath);
-      const relativeTarget = relative(dirname3(symlinkPath), targetPath);
+      const symlinkPath = join(agentSkillsDir, skill.name);
+      const targetPath = join(projectRoot, skill.sourcePath);
+      const relativeTarget = relative(dirname(symlinkPath), targetPath);
       await createSymlink(symlinkPath, relativeTarget, skill.name);
     }
   }
 }
 async function createSymlink(symlinkPath, target, skillName) {
   try {
-    const stats = await lstat2(symlinkPath).catch(() => null);
+    const stats = await lstat(symlinkPath).catch(() => null);
     if (stats) {
       if (stats.isSymbolicLink()) {
         const existingTarget = await readlink(symlinkPath);
         if (existingTarget === target) {
           return;
         }
-        await rm2(symlinkPath);
+        await rm(symlinkPath);
       } else {
         console.warn(
           `Warning: File exists at symlink path for "${skillName}", skipping: ${symlinkPath}`
@@ -1795,11 +1734,11 @@ async function removeAgentSymlinks(skillName, options) {
     if (!config2) {
       continue;
     }
-    const symlinkPath = join5(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
     try {
-      const stats = await lstat2(symlinkPath).catch(() => null);
+      const stats = await lstat(symlinkPath).catch(() => null);
       if (stats?.isSymbolicLink()) {
-        await rm2(symlinkPath);
+        await rm(symlinkPath);
       }
     } catch {
     }
@@ -1822,9 +1761,9 @@ async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
   for (const agentName of agents) {
     const config2 = resolveAgentConfig(agentName, agentConfigs);
     if (!config2) continue;
-    const symlinkPath = join5(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
     try {
-      const stats = await lstat2(symlinkPath);
+      const stats = await lstat(symlinkPath);
       if (stats.isSymbolicLink()) {
         linkedAgents.push(agentName);
       }
@@ -1835,7 +1774,6 @@ async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
 }
 var init_symlinks = __esm({
   "src/symlinks.ts"() {
-    "use strict";
     init_agents();
   }
 });
@@ -1845,18 +1783,28 @@ var add_exports = {};
 __export(add_exports, {
   add: () => add
 });
-import { mkdir as mkdir5, rm as rm3, symlink as symlink2 } from "fs/promises";
-import { dirname as dirname4, join as join6 } from "path";
+function isLocalSpecifier2(specifier) {
+  return specifier.startsWith("file:") || specifier.startsWith("./") || specifier.startsWith("../");
+}
+function parseLocalPath(specifier) {
+  if (specifier.startsWith("file:")) {
+    return specifier.slice(5);
+  }
+  return specifier;
+}
+function normalizeToFileSpecifier(path) {
+  if (path.startsWith("file:")) {
+    return path;
+  }
+  return `file:${path}`;
+}
 async function add(specifiers, options) {
   console.log("Resolving packages...\n");
   const resolvedPackages = [];
   const validationErrors = [];
-  for (let specifier of specifiers) {
+  for (const specifier of specifiers) {
     try {
-      if (isBareLocalPath(specifier)) {
-        specifier = normalizeToFileSpecifier(specifier);
-      }
-      if (isLocalSpecifier(specifier)) {
+      if (isLocalSpecifier2(specifier)) {
         const resolved = await validateLocalPackage(specifier);
         resolvedPackages.push(resolved);
       } else if (isGitHubSpecifier(specifier)) {
@@ -2036,23 +1984,23 @@ async function installFromNode(node, options) {
     throw new Error("Checksum verification failed");
   }
   const skillsDir = getSkillsDir();
-  const destDir = join6(skillsDir, username, name);
-  await mkdir5(destDir, { recursive: true });
-  const { writeFile: writeFile8 } = await import("fs/promises");
-  const tempFile = join6(destDir, ".temp.tgz");
+  const destDir = join(skillsDir, username, name);
+  await mkdir(destDir, { recursive: true });
+  const { writeFile: writeFile8 } = await import('fs/promises');
+  const tempFile = join(destDir, ".temp.tgz");
   await writeFile8(tempFile, tarballBuffer);
-  const { exec: exec2 } = await import("child_process");
-  const { promisify: promisify2 } = await import("util");
+  const { exec: exec2 } = await import('child_process');
+  const { promisify: promisify2 } = await import('util');
   const execAsync = promisify2(exec2);
   try {
-    await rm3(destDir, { recursive: true, force: true });
-    await mkdir5(destDir, { recursive: true });
+    await rm(destDir, { recursive: true, force: true });
+    await mkdir(destDir, { recursive: true });
     await writeFile8(tempFile, tarballBuffer);
     await execAsync(
       `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
     );
   } finally {
-    await rm3(tempFile, { force: true });
+    await rm(tempFile, { force: true });
   }
   const resolvedDeps = {};
   for (const [depName, _range] of Object.entries(node.dependencies)) {
@@ -2221,50 +2169,74 @@ async function installGitHubPackage(resolved, options) {
   console.log(`Location: ${destPath}`);
 }
 async function validateLocalPackage(specifier) {
-  const parsed = parseLocalSpecifier(specifier);
-  if (!parsed) {
+  const path = parseLocalPath(specifier);
+  const resolvedPath = resolve(process.cwd(), path);
+  const normalizedSpecifier = normalizeToFileSpecifier(path);
+  console.log(`Resolving ${specifier}...`);
+  try {
+    const stats = await stat(resolvedPath);
+    if (!stats.isDirectory()) {
+      throw new Error(`Path is not a directory: ${resolvedPath}`);
+    }
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(
+        `Directory not found: ${resolvedPath}
+  Check that the path exists and is accessible.`
+      );
+    }
+    throw error;
+  }
+  let hasSkillMd = false;
+  let hasPspmJson = false;
+  try {
+    await stat(join(resolvedPath, "SKILL.md"));
+    hasSkillMd = true;
+  } catch {
+  }
+  try {
+    await stat(join(resolvedPath, "pspm.json"));
+    hasPspmJson = true;
+  } catch {
+  }
+  if (!hasSkillMd && !hasPspmJson) {
     throw new Error(
-      `Invalid local specifier "${specifier}". Use format: file:../path or file:/absolute/path`
+      `Not a valid skill directory: ${resolvedPath}
+  Missing both SKILL.md and pspm.json. At least one is required.`
     );
   }
-  console.log(`Resolving ${specifier}...`);
-  const resolvedPath = resolveLocalPath(parsed);
-  const validation = await validateLocalSkill(resolvedPath);
-  if (!validation.valid) {
-    throw new Error(validation.error);
-  }
-  const name = validation.manifest?.name || getLocalSkillName(parsed);
-  console.log(`Resolved ${specifier} -> ${name} (local)`);
+  const name = basename(resolvedPath);
+  console.log(`Resolved ${specifier} -> ${resolvedPath}`);
   return {
     type: "local",
     specifier,
-    parsed,
-    name,
-    resolvedPath
+    normalizedSpecifier,
+    path,
+    resolvedPath,
+    name
   };
 }
 async function installLocalPackage(resolved, options) {
-  const { specifier, name, resolvedPath, parsed } = resolved;
-  console.log(`Installing ${specifier} (local symlink)...`);
+  const { specifier, normalizedSpecifier, path, resolvedPath, name } = resolved;
+  console.log(`Installing ${specifier}...`);
   const skillsDir = getSkillsDir();
-  const localDir = join6(skillsDir, "_local");
-  await mkdir5(localDir, { recursive: true });
-  const symlinkPath = join6(localDir, name);
+  const localSkillsDir = join(skillsDir, "_local");
+  await mkdir(localSkillsDir, { recursive: true });
+  const symlinkPath = join(localSkillsDir, name);
+  const relativeTarget = relative(dirname(symlinkPath), resolvedPath);
   try {
-    await rm3(symlinkPath, { force: true });
+    await rm(symlinkPath, { force: true });
   } catch {
   }
-  const { relative: relativePath } = await import("path");
-  const relativeTarget = relativePath(dirname4(symlinkPath), resolvedPath);
-  await symlink2(relativeTarget, symlinkPath);
+  await symlink(relativeTarget, symlinkPath);
   const entry = {
     version: "local",
-    path: parsed.path,
+    path,
     resolvedPath,
     name
   };
-  await addLocalToLockfile(specifier, entry);
-  await addLocalDependency(specifier, "*");
+  await addLocalToLockfile(normalizedSpecifier, entry);
+  await addLocalDependency(normalizedSpecifier);
   const agents = options.resolvedAgents;
   if (agents[0] !== "none") {
     const manifest = await readManifest();
@@ -2283,30 +2255,26 @@ async function installLocalPackage(resolved, options) {
 }
 var init_add = __esm({
   "src/commands/add.ts"() {
-    "use strict";
     init_agents();
     init_api_client();
     init_config();
     init_errors();
     init_github();
     init_lib();
-    init_lockfile();
+    init_lockfile2();
     init_manifest2();
     init_symlinks();
   }
 });
 
-// src/index.ts
-import { readFileSync } from "fs";
-import { dirname as dirname6, join as join13 } from "path";
-import { fileURLToPath } from "url";
-import { Command } from "commander";
-
 // src/commands/access.ts
 init_api_client();
 init_config();
 init_lib();
-async function access2(specifier, options) {
+function isLocalSpecifier(specifier) {
+  return specifier.startsWith("file:") || specifier.startsWith("./") || specifier.startsWith("../");
+}
+async function access(specifier, options) {
   try {
     const apiKey = await requireApiKey();
     const registryUrl = await getRegistryUrl();
@@ -2321,27 +2289,58 @@ async function access2(specifier, options) {
     const visibility = options.public ? "public" : "private";
     let packageName;
     if (specifier) {
+      if (isGitHubSpecifier(specifier)) {
+        const ghSpec = parseGitHubSpecifier(specifier);
+        if (ghSpec) {
+          console.error(`Error: Cannot change visibility of GitHub packages.`);
+          console.error(
+            `  "${specifier}" is hosted on GitHub, not the PSPM registry.`
+          );
+          console.error(
+            `  Visibility can only be changed for packages published to the registry.`
+          );
+        } else {
+          console.error(`Error: Invalid GitHub specifier "${specifier}".`);
+          console.error(`  Use format: github:{owner}/{repo}[/{path}][@{ref}]`);
+        }
+        process.exit(1);
+      }
+      if (isLocalSpecifier(specifier)) {
+        console.error(`Error: Cannot change visibility of local packages.`);
+        console.error(
+          `  "${specifier}" is a local directory, not a registry package.`
+        );
+        console.error(
+          `  Visibility can only be changed for packages published to the registry.`
+        );
+        process.exit(1);
+      }
       const parsed = parseSkillSpecifier(specifier);
       if (!parsed) {
+        console.error(`Error: Invalid package specifier "${specifier}".`);
+        console.error(`  Use format: @user/{username}/{name}`);
+        console.error(``);
+        console.error(`  Examples:`);
+        console.error(`    pspm access @user/myname/my-skill --public`);
         console.error(
-          `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}`
+          `    pspm access --public  (uses current directory's pspm.json)`
         );
         process.exit(1);
       }
       packageName = parsed.name;
     } else {
-      const { readFile: readFile7 } = await import("fs/promises");
-      const { join: join14 } = await import("path");
+      const { readFile: readFile8 } = await import('fs/promises');
+      const { join: join14 } = await import('path');
       let manifest = null;
       try {
-        const content = await readFile7(
+        const content = await readFile8(
           join14(process.cwd(), "pspm.json"),
           "utf-8"
         );
         manifest = JSON.parse(content);
       } catch {
         try {
-          const content = await readFile7(
+          const content = await readFile8(
             join14(process.cwd(), "package.json"),
             "utf-8"
           );
@@ -2389,15 +2388,11 @@ async function access2(specifier, options) {
 
 // src/commands/index.ts
 init_add();
-
-// src/commands/config/init.ts
-import { stat as stat4, writeFile as writeFile5 } from "fs/promises";
-import { join as join7 } from "path";
 async function configInit(options) {
   try {
-    const configPath = join7(process.cwd(), ".pspmrc");
+    const configPath = join(process.cwd(), ".pspmrc");
     try {
-      await stat4(configPath);
+      await stat(configPath);
       console.error("Error: .pspmrc already exists in this directory.");
       process.exit(1);
     } catch {
@@ -2410,7 +2405,7 @@ async function configInit(options) {
       lines.push("; registry = https://custom-registry.example.com");
     }
     lines.push("");
-    await writeFile5(configPath, lines.join("\n"));
+    await writeFile(configPath, lines.join("\n"));
     console.log("Created .pspmrc");
     console.log("");
     console.log("Contents:");
@@ -2523,9 +2518,6 @@ async function deprecate(specifier, message, options) {
 
 // src/commands/init.ts
 init_lib();
-import { readFile as readFile4, stat as stat5, writeFile as writeFile6 } from "fs/promises";
-import { basename, join as join8 } from "path";
-import { createInterface } from "readline";
 function prompt(rl, question, defaultValue) {
   return new Promise((resolve2) => {
     const displayDefault = defaultValue ? ` (${defaultValue})` : "";
@@ -2536,8 +2528,8 @@ function prompt(rl, question, defaultValue) {
 }
 async function readExistingPackageJson() {
   try {
-    const content = await readFile4(
-      join8(process.cwd(), "package.json"),
+    const content = await readFile(
+      join(process.cwd(), "package.json"),
       "utf-8"
     );
     const pkg = JSON.parse(content);
@@ -2554,8 +2546,8 @@ async function readExistingPackageJson() {
 }
 async function getGitAuthor() {
   try {
-    const { exec: exec2 } = await import("child_process");
-    const { promisify: promisify2 } = await import("util");
+    const { exec: exec2 } = await import('child_process');
+    const { promisify: promisify2 } = await import('util');
     const execAsync = promisify2(exec2);
     const [nameResult, emailResult] = await Promise.all([
       execAsync("git config user.name").catch(() => ({ stdout: "" })),
@@ -2581,15 +2573,15 @@ function sanitizeName(name) {
 function isValidName(name) {
   return /^[a-z][a-z0-9_-]*$/.test(name);
 }
-function isValidVersion(version2) {
-  return /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version2);
+function isValidVersion(version3) {
+  return /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version3);
 }
 async function init(options) {
   try {
-    const pspmJsonPath = join8(process.cwd(), "pspm.json");
+    const pspmJsonPath = join(process.cwd(), "pspm.json");
     let exists = false;
     try {
-      await stat5(pspmJsonPath);
+      await stat(pspmJsonPath);
       exists = true;
     } catch {
     }
@@ -2654,10 +2646,10 @@ async function init(options) {
           );
           name = await prompt(rl, "skill name:", sanitizeName(name));
         }
-        let version2 = await prompt(rl, "version:", defaultVersion);
-        while (!isValidVersion(version2)) {
+        let version3 = await prompt(rl, "version:", defaultVersion);
+        while (!isValidVersion(version3)) {
           console.log("  Version must be valid semver (e.g., 1.0.0)");
-          version2 = await prompt(rl, "version:", "0.1.0");
+          version3 = await prompt(rl, "version:", "0.1.0");
         }
         const description = await prompt(
           rl,
@@ -2677,7 +2669,7 @@ async function init(options) {
         manifest = {
           $schema: PSPM_SCHEMA_URL,
           name,
-          version: version2,
+          version: version3,
           description: description || void 0,
           author: author || void 0,
           license,
@@ -2714,17 +2706,17 @@ async function init(options) {
         input: process.stdin,
         output: process.stdout
       });
-      const confirm = await prompt(rl, "Is this OK?", "yes");
+      const confirm2 = await prompt(rl, "Is this OK?", "yes");
       rl.close();
-      if (confirm.toLowerCase() !== "yes" && confirm.toLowerCase() !== "y") {
+      if (confirm2.toLowerCase() !== "yes" && confirm2.toLowerCase() !== "y") {
         console.log("Aborted.");
         process.exit(0);
       }
     }
-    await writeFile6(pspmJsonPath, `${content}
+    await writeFile(pspmJsonPath, `${content}
 `);
     try {
-      await stat5(join8(process.cwd(), "SKILL.md"));
+      await stat(join(process.cwd(), "SKILL.md"));
     } catch {
       console.log(
         "Note: Create a SKILL.md file with your skill's prompt content."
@@ -2749,19 +2741,9 @@ init_config();
 init_errors();
 init_github();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
-import { createHash as createHash2 } from "crypto";
-import {
-  lstat as lstat3,
-  mkdir as mkdir6,
-  readFile as readFile5,
-  rm as rm4,
-  symlink as symlink3,
-  writeFile as writeFile7
-} from "fs/promises";
-import { dirname as dirname5, join as join9, relative as relative2 } from "path";
 function getCacheFilePath(cacheDir, integrity) {
   const match = integrity.match(/^sha256-(.+)$/);
   if (!match) {
@@ -2769,15 +2751,15 @@ function getCacheFilePath(cacheDir, integrity) {
   }
   const base64Hash = match[1];
   const hexHash = Buffer.from(base64Hash, "base64").toString("hex");
-  return join9(cacheDir, `sha256-${hexHash}.tgz`);
+  return join(cacheDir, `sha256-${hexHash}.tgz`);
 }
 async function readFromCache(cacheDir, integrity) {
   try {
     const cachePath = getCacheFilePath(cacheDir, integrity);
-    const data = await readFile5(cachePath);
-    const actualIntegrity = `sha256-${createHash2("sha256").update(data).digest("base64")}`;
+    const data = await readFile(cachePath);
+    const actualIntegrity = `sha256-${createHash("sha256").update(data).digest("base64")}`;
     if (actualIntegrity !== integrity) {
-      await rm4(cachePath, { force: true });
+      await rm(cachePath, { force: true });
       return null;
     }
     return data;
@@ -2787,9 +2769,9 @@ async function readFromCache(cacheDir, integrity) {
 }
 async function writeToCache(cacheDir, integrity, data) {
   try {
-    await mkdir6(cacheDir, { recursive: true });
+    await mkdir(cacheDir, { recursive: true });
     const cachePath = getCacheFilePath(cacheDir, integrity);
-    await writeFile7(cachePath, data);
+    await writeFile(cachePath, data);
   } catch {
   }
 }
@@ -2816,10 +2798,8 @@ async function installFromLockfile(options) {
     let lockfile = await readLockfile();
     const manifestDeps = await getDependencies();
     const manifestGitHubDeps = await getGitHubDependencies();
-    const manifestLocalDeps = await getLocalDependencies();
     const lockfilePackages = lockfile?.packages ?? lockfile?.skills ?? {};
     const lockfileGitHubPackages = lockfile?.githubPackages ?? {};
-    const lockfileLocalPackages = lockfile?.localPackages ?? {};
     const installedSkills = [];
     const missingDeps = [];
     for (const [fullName, versionRange] of Object.entries(manifestDeps)) {
@@ -2970,53 +2950,6 @@ Resolving ${missingGitHubDeps.length} GitHub dependency(ies)...
       }
       lockfile = await readLockfile();
     }
-    const missingLocalDeps = [];
-    for (const [specifier] of Object.entries(manifestLocalDeps)) {
-      if (!lockfileLocalPackages[specifier]) {
-        missingLocalDeps.push({ specifier });
-      }
-    }
-    if (missingLocalDeps.length > 0) {
-      if (options.frozenLockfile) {
-        console.error(
-          "Error: Local dependencies in pspm.json are not in lockfile. Cannot install with --frozen-lockfile"
-        );
-        console.error("Missing local dependencies:");
-        for (const dep of missingLocalDeps) {
-          console.error(`  - ${dep.specifier}`);
-        }
-        process.exit(1);
-      }
-      console.log(
-        `
-Resolving ${missingLocalDeps.length} local dependency(ies)...
-`
-      );
-      for (const { specifier } of missingLocalDeps) {
-        const parsed = parseLocalSpecifier(specifier);
-        if (!parsed) {
-          console.error(`Error: Invalid local specifier: ${specifier}`);
-          continue;
-        }
-        console.log(`Resolving ${specifier}...`);
-        const resolvedPath = resolveLocalPath(parsed);
-        const validation = await validateLocalSkill(resolvedPath);
-        if (!validation.valid) {
-          console.error(`Error: ${validation.error}`);
-          continue;
-        }
-        const name = validation.manifest?.name || parsed.path.split("/").pop() || "unknown";
-        const entry = {
-          version: "local",
-          path: parsed.path,
-          resolvedPath,
-          name
-        };
-        await addLocalToLockfile(specifier, entry);
-        console.log(`  Resolved ${specifier} -> ${name} (local)`);
-      }
-      lockfile = await readLockfile();
-    }
     const manifest = await readManifest();
     const agentConfigs = manifest?.agents;
     let agents;
@@ -3082,7 +3015,7 @@ Installing ${packageCount} registry skill(s)...
             continue;
           }
           tarballBuffer = Buffer.from(await response.arrayBuffer());
-          const actualIntegrity = `sha256-${createHash2("sha256").update(tarballBuffer).digest("base64")}`;
+          const actualIntegrity = `sha256-${createHash("sha256").update(tarballBuffer).digest("base64")}`;
           if (actualIntegrity !== entry.integrity) {
             console.error(
               `  Error: Checksum verification failed for ${fullName}`
@@ -3094,20 +3027,20 @@ Installing ${packageCount} registry skill(s)...
           }
           await writeToCache(cacheDir, entry.integrity, tarballBuffer);
         }
-        const destDir = join9(skillsDir, username, name);
-        await rm4(destDir, { recursive: true, force: true });
-        await mkdir6(destDir, { recursive: true });
-        const tempFile = join9(destDir, ".temp.tgz");
-        await writeFile7(tempFile, tarballBuffer);
-        const { exec: exec2 } = await import("child_process");
-        const { promisify: promisify2 } = await import("util");
+        const destDir = join(skillsDir, username, name);
+        await rm(destDir, { recursive: true, force: true });
+        await mkdir(destDir, { recursive: true });
+        const tempFile = join(destDir, ".temp.tgz");
+        await writeFile(tempFile, tarballBuffer);
+        const { exec: exec2 } = await import('child_process');
+        const { promisify: promisify2 } = await import('util');
         const execAsync = promisify2(exec2);
         try {
           await execAsync(
             `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
           );
         } finally {
-          await rm4(tempFile, { force: true });
+          await rm(tempFile, { force: true });
         }
         console.log(
           `  Installed to ${destDir}${fromCache ? " (from cache)" : ""}`
@@ -3195,52 +3128,6 @@ Installing ${githubCount} GitHub skill(s)...
         }
       }
     }
-    const localPackages = lockfile?.localPackages ?? {};
-    const localCount = Object.keys(localPackages).length;
-    if (localCount > 0) {
-      console.log(`
-Installing ${localCount} local skill(s)...
-`);
-      for (const [specifier, entry] of Object.entries(localPackages)) {
-        const localEntry = entry;
-        console.log(`Installing ${specifier} (local symlink)...`);
-        const validation = await validateLocalSkill(localEntry.resolvedPath);
-        if (!validation.valid) {
-          console.error(`  Error: ${validation.error}`);
-          console.error(
-            `  Hint: The local skill at ${localEntry.resolvedPath} may have been moved or deleted.`
-          );
-          continue;
-        }
-        const localDir = join9(skillsDir, "_local");
-        await mkdir6(localDir, { recursive: true });
-        const symlinkPath = join9(localDir, localEntry.name);
-        try {
-          const stats = await lstat3(symlinkPath);
-          if (stats.isSymbolicLink()) {
-            await rm4(symlinkPath);
-          }
-        } catch {
-        }
-        const relativeTarget = relative2(
-          dirname5(symlinkPath),
-          localEntry.resolvedPath
-        );
-        try {
-          await symlink3(relativeTarget, symlinkPath);
-          console.log(
-            `  Installed to ${symlinkPath} -> ${localEntry.resolvedPath}`
-          );
-          installedSkills.push({
-            name: localEntry.name,
-            sourcePath: getLocalSkillPath(localEntry.name)
-          });
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          console.error(`  Error creating symlink: ${message}`);
-        }
-      }
-    }
     if (installedSkills.length > 0 && agents[0] !== "none") {
       console.log(`
 Creating symlinks for agent(s): ${agents.join(", ")}...`);
@@ -3251,7 +3138,7 @@ Creating symlinks for agent(s): ${agents.join(", ")}...`);
       });
       console.log("  Symlinks created.");
     }
-    const totalCount = packageCount + githubCount + localCount;
+    const totalCount = packageCount + githubCount;
     if (totalCount === 0) {
       console.log("No skills to install.");
     } else {
@@ -3268,7 +3155,7 @@ All ${totalCount} skill(s) installed.`);
 // src/commands/link.ts
 init_agents();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
 async function link(options) {
@@ -3345,11 +3232,9 @@ async function link(options) {
 // src/commands/list.ts
 init_agents();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
-import { access as access3 } from "fs/promises";
-import { join as join10 } from "path";
 async function list(options) {
   try {
     const registrySkills = await listLockfileSkills();
@@ -3364,10 +3249,10 @@ async function list(options) {
       if (!match) continue;
       const [, username, skillName] = match;
       const sourcePath = getRegistrySkillPath(username, skillName);
-      const absolutePath = join10(projectRoot, sourcePath);
+      const absolutePath = join(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access3(absolutePath);
+        await access$1(absolutePath);
       } catch {
         status = "missing";
       }
@@ -3397,10 +3282,10 @@ async function list(options) {
         parsed.repo,
         parsed.path
       );
-      const absolutePath = join10(projectRoot, sourcePath);
+      const absolutePath = join(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access3(absolutePath);
+        await access$1(absolutePath);
       } catch {
         status = "missing";
       }
@@ -3422,35 +3307,6 @@ async function list(options) {
         gitCommit: ghEntry.gitCommit
       });
     }
-    const localSkills = await listLockfileLocalPackages();
-    for (const { specifier, entry } of localSkills) {
-      const localEntry = entry;
-      const skillName = localEntry.name;
-      const sourcePath = getLocalSkillPath(skillName);
-      const absolutePath = join10(projectRoot, sourcePath);
-      let status = "installed";
-      try {
-        await access3(absolutePath);
-      } catch {
-        status = "missing";
-      }
-      const linkedAgents = await getLinkedAgents(
-        skillName,
-        availableAgents,
-        projectRoot,
-        agentConfigs
-      );
-      skills.push({
-        name: skillName,
-        fullName: specifier,
-        version: "local",
-        source: "local",
-        sourcePath,
-        status,
-        linkedAgents,
-        localPath: localEntry.resolvedPath
-      });
-    }
     if (skills.length === 0) {
       console.log("No skills installed.");
       return;
@@ -3463,14 +3319,9 @@ async function list(options) {
     for (const skill of skills) {
       if (skill.source === "registry") {
         console.log(`  ${skill.fullName}@${skill.version} (registry)`);
-      } else if (skill.source === "github") {
+      } else {
         const refInfo = skill.gitRef ? `${skill.gitRef}@${skill.gitCommit?.slice(0, 7)}` : skill.version;
         console.log(`  ${skill.fullName} (${refInfo})`);
-      } else {
-        console.log(`  ${skill.fullName} [local]`);
-        if (skill.localPath) {
-          console.log(`    Path: ${skill.localPath}`);
-        }
       }
       if (skill.status === "missing") {
         console.log(`    Status: MISSING (run 'pspm install' to restore)`);
@@ -3486,11 +3337,9 @@ async function list(options) {
     }
     const registryCount = skills.filter((s) => s.source === "registry").length;
     const githubCount = skills.filter((s) => s.source === "github").length;
-    const localCount = skills.filter((s) => s.source === "local").length;
     const parts = [];
     if (registryCount > 0) parts.push(`${registryCount} registry`);
     if (githubCount > 0) parts.push(`${githubCount} github`);
-    if (localCount > 0) parts.push(`${localCount} local`);
     console.log(`
 Total: ${skills.length} skill(s) (${parts.join(", ")})`);
   } catch (error) {
@@ -3503,26 +3352,30 @@ Total: ${skills.length} skill(s) (${parts.join(", ")})`);
 // src/commands/login.ts
 init_api_client();
 init_config();
-import { randomBytes } from "crypto";
-import http from "http";
-import { URL as URL2 } from "url";
-import open from "open";
 var DEFAULT_WEB_APP_URL = "https://pspm.dev";
 function getWebAppUrl(registryUrl) {
   if (process.env.PSPM_WEB_URL) {
     return process.env.PSPM_WEB_URL.replace(/\/$/, "");
   }
   try {
-    const url = new URL2(registryUrl);
-    return `${url.protocol}//${url.host}`;
+    const url = new URL$1(registryUrl);
+    let host = url.host;
+    if (host.startsWith("registry.")) {
+      host = host.slice("registry.".length);
+    }
+    return `${url.protocol}//${host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
   }
 }
 function getServerUrl(registryUrl) {
   try {
-    const url = new URL2(registryUrl);
-    return `${url.protocol}//${url.host}`;
+    const url = new URL$1(registryUrl);
+    let host = url.host;
+    if (host.startsWith("registry.")) {
+      host = host.slice("registry.".length);
+    }
+    return `${url.protocol}//${host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
   }
@@ -3553,7 +3406,7 @@ function startCallbackServer(expectedState) {
       rejectToken = reject;
     });
     const server = http.createServer((req, res) => {
-      const url = new URL2(req.url || "/", "http://localhost");
+      const url = new URL$1(req.url || "/", "http://localhost");
       if (url.pathname === "/callback") {
         const token = url.searchParams.get("token");
         const state = url.searchParams.get("state");
@@ -3703,8 +3556,7 @@ async function logout() {
 
 // src/commands/migrate.ts
 init_config();
-init_lockfile();
-import { mkdir as mkdir7, readdir as readdir2, rename, rm as rm5, stat as stat6 } from "fs/promises";
+init_lockfile2();
 async function migrate(options) {
   try {
     const legacySkillsDir = getLegacySkillsDir();
@@ -3715,9 +3567,9 @@ async function migrate(options) {
     let migrationNeeded = false;
     const actions = [];
     try {
-      const legacyStats = await stat6(legacySkillsDir);
+      const legacyStats = await stat(legacySkillsDir);
       if (legacyStats.isDirectory()) {
-        const contents = await readdir2(legacySkillsDir);
+        const contents = await readdir(legacySkillsDir);
         if (contents.length > 0) {
           migrationNeeded = true;
           actions.push("Move .skills/ \u2192 .pspm/skills/");
@@ -3726,9 +3578,9 @@ async function migrate(options) {
     } catch {
     }
     try {
-      await stat6(legacyLockfilePath);
+      await stat(legacyLockfilePath);
       try {
-        await stat6(newLockfilePath);
+        await stat(newLockfilePath);
         actions.push(
           "Note: Both skill-lock.json and pspm-lock.json exist. Manual merge may be needed."
         );
@@ -3760,21 +3612,21 @@ async function migrate(options) {
       console.log("  \u2713 Migrated skill-lock.json \u2192 pspm-lock.json");
     }
     try {
-      const legacyStats = await stat6(legacySkillsDir);
+      const legacyStats = await stat(legacySkillsDir);
       if (legacyStats.isDirectory()) {
-        const contents = await readdir2(legacySkillsDir);
+        const contents = await readdir(legacySkillsDir);
         if (contents.length > 0) {
-          await mkdir7(pspmDir, { recursive: true });
+          await mkdir(pspmDir, { recursive: true });
           try {
-            const newStats = await stat6(newSkillsDir);
+            const newStats = await stat(newSkillsDir);
             if (newStats.isDirectory()) {
-              const newContents = await readdir2(newSkillsDir);
+              const newContents = await readdir(newSkillsDir);
               if (newContents.length > 0) {
                 console.log(
                   "  ! Both .skills/ and .pspm/skills/ have content. Manual merge required."
                 );
               } else {
-                await rm5(newSkillsDir, { recursive: true, force: true });
+                await rm(newSkillsDir, { recursive: true, force: true });
                 await rename(legacySkillsDir, newSkillsDir);
                 console.log("  \u2713 Moved .skills/ \u2192 .pspm/skills/");
               }
@@ -3810,24 +3662,32 @@ init_api_client();
 init_config();
 init_errors();
 init_lib();
-import { exec as execCb } from "child_process";
-import { createHash as createHash3 } from "crypto";
-import { readdir as readdir3, readFile as readFile6, stat as stat7 } from "fs/promises";
-import { join as join11, relative as relative3 } from "path";
-import { promisify } from "util";
-var exec = promisify(execCb);
+var exec = promisify(exec$1);
+function confirm(question) {
+  return new Promise((resolve2) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.question(`${question} (y/N) `, (answer) => {
+      rl.close();
+      const normalized = answer.trim().toLowerCase();
+      resolve2(normalized === "y" || normalized === "yes");
+    });
+  });
+}
 async function detectManifest() {
   const cwd = process.cwd();
-  const pspmJsonPath = join11(cwd, "pspm.json");
+  const pspmJsonPath = join(cwd, "pspm.json");
   try {
-    const content = await readFile6(pspmJsonPath, "utf-8");
+    const content = await readFile(pspmJsonPath, "utf-8");
     const manifest = JSON.parse(content);
     return { type: "pspm.json", manifest, path: pspmJsonPath };
   } catch {
   }
-  const packageJsonPath = join11(cwd, "package.json");
+  const packageJsonPath = join(cwd, "package.json");
   try {
-    const content = await readFile6(packageJsonPath, "utf-8");
+    const content = await readFile(packageJsonPath, "utf-8");
     const packageJson2 = JSON.parse(content);
     const manifest = {
       name: packageJson2.name,
@@ -3835,7 +3695,8 @@ async function detectManifest() {
       description: packageJson2.description,
       author: typeof packageJson2.author === "string" ? packageJson2.author : packageJson2.author?.name,
       license: packageJson2.license,
-      files: packageJson2.files
+      files: packageJson2.files,
+      dependencies: packageJson2.dependencies
     };
     return { type: "package.json", manifest, path: packageJsonPath };
   } catch {
@@ -3847,21 +3708,31 @@ function formatBytes(bytes) {
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}kB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
-async function getFilesWithSizes(dir, baseDir) {
+async function getFilesWithSizes(dir, baseDir, ignoreResult) {
   const results = [];
   try {
-    const entries = await readdir3(dir, { withFileTypes: true });
+    const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join11(dir, entry.name);
-      const relativePath = relative3(baseDir, fullPath);
-      if (entry.name === "node_modules" || entry.name === ".git") {
+      const fullPath = join(dir, entry.name);
+      const relativePath = relative(baseDir, fullPath);
+      if (ALWAYS_IGNORED.includes(entry.name)) {
         continue;
       }
+      if (ignoreResult?.ig) {
+        const pathToCheck = entry.isDirectory() ? `${relativePath}/` : relativePath;
+        if (ignoreResult.ig.ignores(pathToCheck)) {
+          continue;
+        }
+      }
       if (entry.isDirectory()) {
-        const subFiles = await getFilesWithSizes(fullPath, baseDir);
+        const subFiles = await getFilesWithSizes(
+          fullPath,
+          baseDir,
+          ignoreResult
+        );
         results.push(...subFiles);
       } else {
-        const fileStat = await stat7(fullPath);
+        const fileStat = await stat(fullPath);
         results.push({ path: relativePath, size: fileStat.size });
       }
     }
@@ -3887,15 +3758,40 @@ async function publishCommand(options) {
       console.error(`Error: ${validation.error}`);
       process.exit(1);
     }
+    const skillMdPath = join(process.cwd(), "SKILL.md");
+    try {
+      await stat(skillMdPath);
+    } catch {
+      console.error(
+        "Error: SKILL.md is required. Create a SKILL.md file with your skill's documentation before publishing."
+      );
+      process.exit(1);
+    }
+    if (options.access === "public") {
+      console.log("");
+      console.log("\u26A0\uFE0F  Warning: You are about to publish this skill as PUBLIC.");
+      console.log(
+        "   Once a skill is public, it CANNOT be made private again."
+      );
+      console.log("   This action is irreversible.");
+      console.log("");
+      const confirmed = await confirm("Do you want to continue?");
+      if (!confirmed) {
+        console.log("Publish cancelled.");
+        process.exit(0);
+      }
+      console.log("");
+    }
     const packageJson2 = {
       name: manifest.name,
       version: manifest.version,
       description: manifest.description,
-      files: manifest.files
+      files: manifest.files,
+      dependencies: manifest.dependencies
     };
     if (options.bump) {
-      const semver2 = await import("semver");
-      const newVersion = semver2.default.inc(packageJson2.version, options.bump);
+      const semver3 = await import('semver');
+      const newVersion = semver3.default.inc(packageJson2.version, options.bump);
       if (!newVersion) {
         console.error(
           `Error: Failed to bump version from ${packageJson2.version}`
@@ -3905,9 +3801,16 @@ async function publishCommand(options) {
       packageJson2.version = newVersion;
       console.log(`Bumped version to ${newVersion}`);
     }
+    const ignoreResult = await loadIgnorePatterns();
+    if (ignoreResult.source) {
+      console.log(
+        `pspm notice Using ${ignoreResult.source} for ignore patterns`
+      );
+    }
+    const excludeArgs = getExcludeArgsForRsync(ignoreResult.patterns);
     const safeName = packageJson2.name.replace(/[@/]/g, "-").replace(/^-+/, "");
     const tarballName = `${safeName}-${packageJson2.version}.tgz`;
-    const tempDir = join11(process.cwd(), ".pspm-publish");
+    const tempDir = join(process.cwd(), ".pspm-publish");
     try {
       await exec(`rm -rf "${tempDir}" && mkdir -p "${tempDir}"`);
       const files = packageJson2.files || [...DEFAULT_SKILL_FILES];
@@ -3915,7 +3818,7 @@ async function publishCommand(options) {
       for (const file of files) {
         try {
           await exec(
-            `rsync -a --exclude='node_modules' --exclude='.git' "${file}" "${tempDir}/package/" 2>/dev/null || true`
+            `rsync -a ${excludeArgs} "${file}" "${tempDir}/package/" 2>/dev/null || true`
           );
         } catch {
         }
@@ -3923,7 +3826,7 @@ async function publishCommand(options) {
       if (detection.type === "pspm.json") {
         await exec(`cp pspm.json "${tempDir}/package/"`);
         try {
-          await stat7(join11(process.cwd(), "package.json"));
+          await stat(join(process.cwd(), "package.json"));
           await exec(
             `cp package.json "${tempDir}/package/" 2>/dev/null || true`
           );
@@ -3932,30 +3835,51 @@ async function publishCommand(options) {
       } else {
         await exec(`cp package.json "${tempDir}/package/"`);
       }
-      const packageDir = join11(tempDir, "package");
-      const tarballContents = await getFilesWithSizes(packageDir, packageDir);
+      const packageDir = join(tempDir, "package");
+      const tarballContents = await getFilesWithSizes(
+        packageDir,
+        packageDir,
+        ignoreResult
+      );
       const unpackedSize = tarballContents.reduce((acc, f) => acc + f.size, 0);
-      const tarballPath = join11(tempDir, tarballName);
+      const tarballPath = join(tempDir, tarballName);
       await exec(
-        `tar -czf "${tarballPath}" -C "${tempDir}" --exclude='node_modules' --exclude='.git' package`
+        `tar -czf "${tarballPath}" -C "${tempDir}" ${excludeArgs} package`
       );
-      const tarballBuffer = await readFile6(tarballPath);
+      const tarballBuffer = await readFile(tarballPath);
       const tarballBase64 = tarballBuffer.toString("base64");
       const tarballSize = tarballBuffer.length;
-      const shasum = createHash3("sha1").update(tarballBuffer).digest("hex");
-      const integrityHash = createHash3("sha512").update(tarballBuffer).digest("base64");
+      const shasum = createHash("sha1").update(tarballBuffer).digest("hex");
+      const integrityHash = createHash("sha512").update(tarballBuffer).digest("base64");
       const integrity = `sha512-${integrityHash}`;
+      const MAX_TARBALL_SIZE = 10 * 1024 * 1024;
+      if (tarballSize > MAX_TARBALL_SIZE) {
+        console.error("");
+        console.error(
+          `Error: Package size ${formatBytes(tarballSize)} exceeds the maximum allowed size of ${formatBytes(MAX_TARBALL_SIZE)}.`
+        );
+        console.error("");
+        console.error("To reduce the package size:");
+        console.error(
+          '  - Add a "files" field in your manifest to include only necessary files'
+        );
+        console.error("  - Add patterns to .pspmignore to exclude large files");
+        console.error(
+          "  - Remove build artifacts, tests, and documentation from the package"
+        );
+        process.exit(1);
+      }
       console.log("");
       console.log("pspm notice");
       console.log(`pspm notice \u{1F4E6}  ${packageJson2.name}@${packageJson2.version}`);
-      console.log("pspm notice Tarball Contents");
+      console.log("pspm notice === Tarball Contents ===");
       tarballContents.sort((a, b) => b.size - a.size);
       for (const file of tarballContents) {
         console.log(
           `pspm notice ${formatBytes(file.size).padStart(8)} ${file.path}`
         );
       }
-      console.log("pspm notice Tarball Details");
+      console.log("pspm notice === Tarball Details ===");
       console.log(`pspm notice name:          ${packageJson2.name}`);
       console.log(`pspm notice version:       ${packageJson2.version}`);
       console.log(`pspm notice filename:      ${tarballName}`);
@@ -3967,11 +3891,20 @@ async function publishCommand(options) {
       );
       console.log(`pspm notice total files:   ${tarballContents.length}`);
       console.log("pspm notice");
+      const confirmed = await confirm(
+        `Publish ${packageJson2.name}@${packageJson2.version} to ${registryUrl}?`
+      );
+      if (!confirmed) {
+        console.log("Publish cancelled.");
+        process.exit(0);
+      }
+      console.log("");
       console.log(`pspm notice Publishing to ${registryUrl} with tag latest`);
       configure2({ registryUrl, apiKey });
       const response = await publishSkill({
         manifest: packageJson2,
-        tarballBase64
+        tarballBase64,
+        visibility: options.access
       });
       if (response.status !== 200) {
         const errorMessage = extractApiErrorMessage(response, "Publish failed");
@@ -3984,28 +3917,17 @@ async function publishCommand(options) {
         throw new Error(errorMessage);
       }
       const result = response.data;
+      const visibility = result.skill.visibility;
+      const visibilityIcon = visibility === "public" ? "\u{1F310}" : "\u{1F512}";
       console.log(
         `+ @user/${result.skill.username}/${result.skill.name}@${result.version.version}`
       );
       console.log(`Checksum: ${result.version.checksum}`);
-      if (options.access) {
-        console.log(`
-Setting visibility to ${options.access}...`);
-        const accessResponse = await changeSkillAccess(packageJson2.name, {
-          visibility: options.access
-        });
-        if (accessResponse.status !== 200 || !accessResponse.data) {
-          console.warn(
-            `Warning: Failed to set visibility: ${accessResponse.error ?? "Unknown error"}`
-          );
-        } else {
-          console.log(`Package is now ${accessResponse.data.visibility}`);
-          if (options.access === "public") {
-            console.log(
-              "Note: This action is irreversible. Public packages cannot be made private."
-            );
-          }
-        }
+      console.log(`Visibility: ${visibilityIcon} ${visibility}`);
+      if (visibility === "public") {
+        console.log(
+          "Note: Public packages cannot be made private. This is irreversible."
+        );
       }
     } finally {
       await exec(`rm -rf "${tempDir}"`).catch(() => {
@@ -4025,19 +3947,15 @@ Setting visibility to ${options.access}...`);
 init_agents();
 init_config();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_manifest2();
 init_symlinks();
-import { rm as rm6 } from "fs/promises";
-import { join as join12 } from "path";
 async function remove(nameOrSpecifier) {
   try {
     const manifest = await readManifest();
     const agentConfigs = manifest?.agents;
     const agents = getAvailableAgents(agentConfigs);
-    if (isLocalSpecifier(nameOrSpecifier)) {
-      await removeLocal(nameOrSpecifier, agents, agentConfigs);
-    } else if (isGitHubSpecifier(nameOrSpecifier)) {
+    if (isGitHubSpecifier(nameOrSpecifier)) {
       await removeGitHub(nameOrSpecifier, agents, agentConfigs);
     } else if (nameOrSpecifier.startsWith("@user/")) {
       await removeRegistry(nameOrSpecifier, agents, agentConfigs);
@@ -4072,9 +3990,9 @@ async function removeRegistry(specifier, agents, agentConfigs) {
     agentConfigs
   });
   const skillsDir = getSkillsDir();
-  const destDir = join12(skillsDir, username, name);
+  const destDir = join(skillsDir, username, name);
   try {
-    await rm6(destDir, { recursive: true, force: true });
+    await rm(destDir, { recursive: true, force: true });
   } catch {
   }
   console.log(`Removed ${fullName}`);
@@ -4101,42 +4019,13 @@ async function removeGitHub(specifier, agents, agentConfigs) {
   });
   const skillsDir = getSkillsDir();
   const destPath = getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path);
-  const destDir = join12(skillsDir, "..", destPath);
+  const destDir = join(skillsDir, "..", destPath);
   try {
-    await rm6(destDir, { recursive: true, force: true });
+    await rm(destDir, { recursive: true, force: true });
   } catch {
   }
   console.log(`Removed ${lockfileKey}`);
 }
-async function removeLocal(specifier, agents, agentConfigs) {
-  const parsed = parseLocalSpecifier(specifier);
-  if (!parsed) {
-    console.error(`Error: Invalid local specifier: ${specifier}`);
-    process.exit(1);
-  }
-  console.log(`Removing ${specifier}...`);
-  const removedFromLockfile = await removeLocalFromLockfile(specifier);
-  const removedFromManifest = await removeLocalDependency(specifier);
-  if (!removedFromLockfile && !removedFromManifest) {
-    console.error(`Error: ${specifier} not found in lockfile or pspm.json`);
-    process.exit(1);
-  }
-  const localSkills = await listLockfileLocalPackages();
-  const foundLocal = localSkills.find((s) => s.specifier === specifier);
-  const skillName = foundLocal?.entry.name || parsed.path.split("/").filter(Boolean).pop() || "unknown";
-  await removeAgentSymlinks(skillName, {
-    agents,
-    projectRoot: process.cwd(),
-    agentConfigs
-  });
-  const skillsDir = getSkillsDir();
-  const symlinkPath = join12(skillsDir, "_local", skillName);
-  try {
-    await rm6(symlinkPath, { force: true });
-  } catch {
-  }
-  console.log(`Removed ${specifier}`);
-}
 async function removeByShortName(shortName, agents, agentConfigs) {
   const registrySkills = await listLockfileSkills();
   const foundRegistry = registrySkills.find((s) => {
@@ -4157,12 +4046,6 @@ async function removeByShortName(shortName, agents, agentConfigs) {
     await removeGitHub(foundGitHub.specifier, agents, agentConfigs);
     return;
   }
-  const localSkills = await listLockfileLocalPackages();
-  const foundLocal = localSkills.find((s) => s.entry.name === shortName);
-  if (foundLocal) {
-    await removeLocal(foundLocal.specifier, agents, agentConfigs);
-    return;
-  }
   console.error(`Error: Skill "${shortName}" not found in lockfile`);
   process.exit(1);
 }
@@ -4234,7 +4117,7 @@ init_api_client();
 init_config();
 init_errors();
 init_lib();
-init_lockfile();
+init_lockfile2();
 init_add();
 async function update(options) {
   try {
@@ -4307,6 +4190,52 @@ async function update(options) {
   }
 }
 
+// src/commands/version.ts
+init_manifest2();
+async function version(bump, options = {}) {
+  try {
+    const manifest = await readManifest();
+    if (!manifest) {
+      console.error("Error: No pspm.json found in current directory.");
+      console.error("Run 'pspm init' to create one.");
+      process.exit(1);
+    }
+    if (!manifest.version) {
+      console.error("Error: pspm.json does not have a version field.");
+      console.error(
+        'Add a version field (e.g., "version": "0.1.0") to your pspm.json.'
+      );
+      process.exit(1);
+    }
+    if (!semver__default.valid(manifest.version)) {
+      console.error(
+        `Error: Current version "${manifest.version}" is not valid semver.`
+      );
+      console.error(
+        'Fix the version in pspm.json to be valid semver (e.g., "1.0.0").'
+      );
+      process.exit(1);
+    }
+    const newVersion = semver__default.inc(manifest.version, bump);
+    if (!newVersion) {
+      console.error(`Error: Failed to bump version from ${manifest.version}`);
+      process.exit(1);
+    }
+    if (options.dryRun) {
+      console.log(`Would bump version: ${manifest.version} \u2192 ${newVersion}`);
+      return;
+    }
+    manifest.version = newVersion;
+    await writeManifest(manifest);
+    console.log(`v${newVersion}`);
+    console.log(`Updated ${getManifestPath()}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
+
 // src/commands/whoami.ts
 init_api_client();
 init_config();
@@ -4335,13 +4264,13 @@ async function whoami() {
 }
 
 // src/index.ts
-var __dirname = dirname6(fileURLToPath(import.meta.url));
+var __dirname$1 = dirname(fileURLToPath(import.meta.url));
 var packageJson = JSON.parse(
-  readFileSync(join13(__dirname, "..", "package.json"), "utf-8")
+  readFileSync(join(__dirname$1, "..", "package.json"), "utf-8")
 );
-var version = packageJson.version;
+var version2 = packageJson.version;
 var program = new Command();
-program.name("pspm").description("Prompt Skill Package Manager for AI coding agents").version(version);
+program.name("pspm").description("Prompt Skill Package Manager for AI coding agents").version(version2);
 var configCmd = program.command("config").description("Manage PSPM configuration");
 configCmd.command("show").description("Show resolved configuration").action(async () => {
   await configShow();
@@ -4417,6 +4346,17 @@ program.command("link").description("Recreate agent symlinks without reinstallin
 program.command("update").description("Update all skills to latest compatible versions").option("--dry-run", "Show what would be updated without making changes").action(async (options) => {
   await update({ dryRun: options.dryRun });
 });
+program.command("version <bump>").description("Bump package version (major, minor, patch)").option("--dry-run", "Show what would be changed without writing").action(async (bump, options) => {
+  const validBumps = ["major", "minor", "patch"];
+  if (!validBumps.includes(bump)) {
+    console.error(`Error: Invalid version bump "${bump}".`);
+    console.error("Must be one of: major, minor, patch");
+    process.exit(1);
+  }
+  await version(bump, {
+    dryRun: options.dryRun
+  });
+});
 program.command("publish").description("Publish current directory as a skill").option("--bump <level>", "Bump version (major, minor, patch)").option("--tag <tag>", "Tag for the release").option("--access <level>", "Set package visibility (public or private)").action(async (options) => {
   await publishCommand({
     bump: options.bump,
@@ -4430,7 +4370,7 @@ program.command("unpublish <specifier>").description(
   await unpublish(specifier, { force: options.force });
 });
 program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public (irreversible)").option("--private", "Make the package private (only for private packages)").action(async (specifier, options) => {
-  await access2(specifier, {
+  await access(specifier, {
     public: options.public,
     private: options.private
   });
@@ -4441,4 +4381,5 @@ program.command("deprecate <specifier> [message]").description(
   await deprecate(specifier, message, { undo: options.undo });
 });
 program.parse();
+//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map