@anytio/pspm 0.4.1 → 0.6.0

package/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to the PSPM CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-02-17
+
+### Changed
+
+- **Auth-free read operations**: API key is no longer required for non-write operations (`add`, `install`, `update`, `list`, `link`). Only `publish`, `unpublish`, `deprecate`, `access`, and `whoami` now require authentication.
+- Made `apiKey` parameter optional in SDK configuration, eliminating `apiKey ?? ""` workaround patterns
+
+### Fixed
+
+- `update` command no longer blocks users without a PSPM API key when they only have GitHub or public packages installed
+
+## [0.5.1] - 2026-02-10
+
+### Changed
+
+- Updated skill download endpoint to use OpenAPI route for improved type safety and consistency
+
+## [0.5.0] - 2026-02-10
+
+### Added
+
+- **Public skill exploration**: New `/-/explore` endpoint support for browsing public skills without authentication, with search, sorting (downloads/recent/name), and pagination
+- **SKILL.md publish requirement**: CLI now validates that `SKILL.md` exists before publishing, with clear guidance to create one
+- **API key permissions**: SDK types now support granular API key permissions (`read`, `write`, `delete`)
+- **Skill detail with documentation**: Get skill endpoint now returns `skillMd` content from the latest published version
+
+### Changed
+
+- **Route structure redesign**: All API routes restructured with `/@user/{username}/` prefix for resource routes and `/-/` prefix for action routes (publish, mine, me, explore)
+- **Username required in operations**: Deprecate, undeprecate, access, delete, and unpublish commands now pass username explicitly in API calls
+- **Reduced tarball max size**: Publish size limit tightened in SDK schema validation
+- **Updated all dependencies**: Bumped all outdated packages including Orval 8.0.3 → 8.2.0
+
+### Fixed
+
+- **Username resolution in access command**: Properly resolves username from specifier or config with helpful error messages
+
 ## [0.4.1] - 2026-02-09
 
 ### Changed

package/dist/index.js

@@ -74,12 +74,12 @@ var init_fetcher = __esm({
 });
 
 // src/sdk/generated/index.ts
-var getMeUrl, me, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getPublishSkillUrl, publishSkill, getDeleteSkillUrl, deleteSkill, getDeleteSkillVersionUrl, deleteSkillVersion;
+var getMeUrl, me, getDeleteSkillUrl, deleteSkill, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getDeleteSkillVersionUrl, deleteSkillVersion, getPublishSkillUrl, publishSkill;
 var init_generated = __esm({
   "src/sdk/generated/index.ts"() {
     init_fetcher();
     getMeUrl = () => {
-      return `/api/skills/me`;
+      return `/api/skills/-/me`;
     };
     me = async (options) => {
       return customFetch(
@@ -90,6 +90,18 @@ var init_generated = __esm({
         }
       );
     };
+    getDeleteSkillUrl = (username, name) => {
+      return `/api/skills/@user/${username}/${name}`;
+    };
+    deleteSkill = async (username, name, options) => {
+      return customFetch(
+        getDeleteSkillUrl(username, name),
+        {
+          ...options,
+          method: "DELETE"
+        }
+      );
+    };
     getListSkillVersionsUrl = (username, name) => {
       return `/api/skills/@user/${username}/${name}/versions`;
     };
@@ -103,7 +115,7 @@ var init_generated = __esm({
       );
     };
     getGetSkillVersionUrl = (username, name, version3) => {
-      return `/api/skills/@user/${username}/${name}/${version3}`;
+      return `/api/skills/@user/${username}/${name}/versions/${version3}`;
     };
     getSkillVersion = async (username, name, version3, options) => {
       return customFetch(
@@ -114,43 +126,31 @@ var init_generated = __esm({
         }
       );
     };
-    getPublishSkillUrl = () => {
-      return `/api/skills/publish`;
-    };
-    publishSkill = async (publishSkillInput, options) => {
-      return customFetch(
-        getPublishSkillUrl(),
-        {
-          ...options,
-          method: "POST",
-          headers: { "Content-Type": "application/json", ...options?.headers },
-          body: JSON.stringify(
-            publishSkillInput
-          )
-        }
-      );
-    };
-    getDeleteSkillUrl = (name) => {
-      return `/api/skills/${name}`;
+    getDeleteSkillVersionUrl = (username, name, version3) => {
+      return `/api/skills/@user/${username}/${name}/versions/${version3}`;
     };
-    deleteSkill = async (name, options) => {
+    deleteSkillVersion = async (username, name, version3, options) => {
       return customFetch(
-        getDeleteSkillUrl(name),
+        getDeleteSkillVersionUrl(username, name, version3),
         {
           ...options,
           method: "DELETE"
         }
       );
     };
-    getDeleteSkillVersionUrl = (name, version3) => {
-      return `/api/skills/${name}/${version3}`;
+    getPublishSkillUrl = () => {
+      return `/api/skills/-/publish`;
     };
-    deleteSkillVersion = async (name, version3, options) => {
+    publishSkill = async (publishSkillInput, options) => {
       return customFetch(
-        getDeleteSkillVersionUrl(name, version3),
+        getPublishSkillUrl(),
         {
           ...options,
-          method: "DELETE"
+          method: "POST",
+          headers: { "Content-Type": "application/json", ...options?.headers },
+          body: JSON.stringify(
+            publishSkillInput
+          )
         }
       );
     };
@@ -181,14 +181,14 @@ async function whoamiRequest(registryUrl, apiKey) {
     return null;
   }
 }
-async function deprecateSkillVersion(skillName, version3, message) {
+async function deprecateSkillVersion(username, skillName, version3, message) {
   const config2 = getConfig();
   if (!config2) {
     return { status: 401, error: "SDK not configured" };
   }
   try {
     const response = await fetch(
-      `${config2.baseUrl}/api/skills/${skillName}/${version3}/deprecate`,
+      `${config2.baseUrl}/api/skills/@user/${username}/${skillName}/versions/${version3}/deprecate`,
       {
         method: "POST",
         headers: {
@@ -211,14 +211,14 @@ async function deprecateSkillVersion(skillName, version3, message) {
     };
   }
 }
-async function undeprecateSkillVersion(skillName, version3) {
+async function undeprecateSkillVersion(username, skillName, version3) {
   const config2 = getConfig();
   if (!config2) {
     return { status: 401, error: "SDK not configured" };
   }
   try {
     const response = await fetch(
-      `${config2.baseUrl}/api/skills/${skillName}/${version3}/deprecate`,
+      `${config2.baseUrl}/api/skills/@user/${username}/${skillName}/versions/${version3}/deprecate`,
       {
         method: "DELETE",
         headers: {
@@ -239,14 +239,14 @@ async function undeprecateSkillVersion(skillName, version3) {
     };
   }
 }
-async function changeSkillAccess(skillName, input) {
+async function changeSkillAccess(username, skillName, input) {
   const config2 = getConfig();
   if (!config2) {
     return { status: 401, error: "SDK not configured" };
   }
   try {
     const response = await fetch(
-      `${config2.baseUrl}/api/skills/${skillName}/access`,
+      `${config2.baseUrl}/api/skills/@user/${username}/${skillName}/access`,
       {
         method: "POST",
         headers: {
@@ -772,7 +772,7 @@ async function resolveRecursive(rootDeps, config2) {
   };
   configure2({
     registryUrl: config2.registryUrl,
-    apiKey: config2.apiKey ?? ""
+    apiKey: config2.apiKey
   });
   const rangesByPackage = /* @__PURE__ */ new Map();
   const queue = [];
@@ -2047,7 +2047,7 @@ async function validateRegistryPackage(specifier) {
     );
   }
   const { username, name, versionRange } = parsed;
-  configure2({ registryUrl, apiKey: apiKey ?? "" });
+  configure2({ registryUrl, apiKey });
   console.log(`Resolving ${specifier}...`);
   const versionsResponse = await listSkillVersions(username, name);
   if (versionsResponse.status !== 200) {
@@ -2288,6 +2288,7 @@ async function access(specifier, options) {
     }
     const visibility = options.public ? "public" : "private";
     let packageName;
+    let packageUsername;
     if (specifier) {
       if (isGitHubSpecifier(specifier)) {
         const ghSpec = parseGitHubSpecifier(specifier);
@@ -2328,6 +2329,7 @@ async function access(specifier, options) {
         process.exit(1);
       }
       packageName = parsed.name;
+      packageUsername = parsed.username;
     } else {
       const { readFile: readFile8 } = await import('fs/promises');
       const { join: join14 } = await import('path');
@@ -2361,9 +2363,21 @@ async function access(specifier, options) {
       }
       packageName = manifest.name;
     }
+    if (!packageUsername) {
+      const config2 = await resolveConfig();
+      packageUsername = config2.username;
+    }
+    if (!packageUsername) {
+      console.error(
+        "Error: Could not determine username. Please use the full specifier: @user/{username}/{name}"
+      );
+      process.exit(1);
+    }
     configure2({ registryUrl, apiKey });
     console.log(`Setting ${packageName} to ${visibility}...`);
-    const response = await changeSkillAccess(packageName, { visibility });
+    const response = await changeSkillAccess(packageUsername, packageName, {
+      visibility
+    });
     if (response.status !== 200 || !response.data) {
       const errorMessage = response.error ?? "Failed to change visibility";
       console.error(`Error: ${errorMessage}`);
@@ -2476,7 +2490,11 @@ async function deprecate(specifier, message, options) {
       console.log(
         `Removing deprecation from @user/${username}/${name}@${versionRange}...`
       );
-      const response = await undeprecateSkillVersion(name, versionRange);
+      const response = await undeprecateSkillVersion(
+        username,
+        name,
+        versionRange
+      );
       if (response.status !== 200) {
         console.error(
           `Error: ${response.error || "Failed to remove deprecation"}`
@@ -2494,7 +2512,12 @@ async function deprecate(specifier, message, options) {
         process.exit(1);
       }
       console.log(`Deprecating @user/${username}/${name}@${versionRange}...`);
-      const response = await deprecateSkillVersion(name, versionRange, message);
+      const response = await deprecateSkillVersion(
+        username,
+        name,
+        versionRange,
+        message
+      );
       if (response.status !== 200) {
         console.error(
           `Error: ${response.error || "Failed to deprecate version"}`
@@ -2820,7 +2843,7 @@ async function installFromLockfile(options) {
       }
       console.log(`Resolving ${missingDeps.length} new dependency(ies)...
 `);
-      configure2({ registryUrl, apiKey: apiKey ?? "" });
+      configure2({ registryUrl, apiKey });
       for (const { fullName, versionRange } of missingDeps) {
         const parsed = parseSkillSpecifier(fullName);
         if (!parsed) {
@@ -4076,7 +4099,7 @@ async function unpublish(specifier, options) {
         );
         process.exit(1);
       }
-      const response = await deleteSkillVersion(name, versionRange);
+      const response = await deleteSkillVersion(username, name, versionRange);
       if (response.status !== 200) {
         const errorMessage = extractApiErrorMessage(
           response,
@@ -4094,7 +4117,7 @@ async function unpublish(specifier, options) {
         );
         process.exit(1);
       }
-      const response = await deleteSkill(name);
+      const response = await deleteSkill(username, name);
       if (response.status !== 200) {
         const errorMessage = extractApiErrorMessage(
           response,
@@ -4121,8 +4144,9 @@ init_lockfile2();
 init_add();
 async function update(options) {
   try {
-    const apiKey = await requireApiKey();
-    const registryUrl = await getRegistryUrl();
+    const config2 = await resolveConfig();
+    const registryUrl = config2.registryUrl;
+    const apiKey = getTokenForRegistry(config2, registryUrl);
     const skills = await listLockfileSkills();
     if (skills.length === 0) {
       console.log("No skills installed.");