@anytio/pspm 0.9.2 → 0.11.0

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to the PSPM CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.0] - 2026-03-17
+
+### Added
+
+- **Skill list install**: Install all skills from a curated skill list with `pspm install --list @user/username/list-name`
+  - Supports both user and org lists: `@user/{username}/{list-name}` or `@org/{orgname}/{list-name}`
+  - Fetches list from the registry API and resolves items to registry specifiers
+  - Respects pinned versions when specified in the list
+  - Can be combined with explicit specifiers for additional packages
+
+### Changed
+
+- Updated all dependencies to latest versions
+
+## [0.10.0] - 2026-03-14
+
+### Added
+
+- **Organization publishing**: Publish skills under an org namespace with `pspm publish --org <orgname>`
+  - `pspm publish --access team --org myorg` — publish as team-visible under `@org/myorg/skill-name`
+  - `pspm publish --access public --org myorg` — publish as public under org namespace
+- **Team visibility**: New `--access team` option restricts package access to org members only
+- **Org namespace resolution**: `@org/` namespace fully supported in dependency resolution
+  - Install org-scoped packages: `pspm add @org/myorg/skill-name`
+  - Recursive dependency resolution for org packages
+
 ## [0.9.2] - 2026-03-10
 
 ### Changed

package/README.md

@@ -9,7 +9,7 @@ Supports **Claude Code**, **Cursor**, **Codex**, **Gemini CLI**, **Windsurf**, a
 ## Install a Skill
 
 ```bash
-npx @anytio/pspm add vercel-labs/agent-skills
+npx @anytio/pspm add @user/anyt/youtube-downloader
 ```
 
 ### Source Formats
@@ -146,6 +146,10 @@ pspm install --dir ./custom-path
 
 # Install specific packages
 pspm install @user/alice/skill1 github:org/repo
+
+# Install all skills from a skill list
+pspm install --list @user/alice/my-favorites
+pspm install --list @org/myorg/team-skills
 ```
 
 ### `pspm search`
@@ -351,10 +355,11 @@ pspm version patch --dry-run      # Preview without writing
 ```bash
 pspm publish --access public      # Publish as public (irreversible)
 pspm publish --access private     # Publish as private (requires Pro)
+pspm publish --access team --org myorg       # Publish under org (team-only)
 pspm publish --access private --bump patch   # Bump and publish
 ```
 
-`--access` is required. Before uploading, `pspm publish` shows a preview of included files and package size. Max package size is **10MB**.
+`--access` is required (`public`, `private`, or `team`). Use `--org <orgname>` to publish under an organization namespace. `--access team` requires `--org`. Before uploading, `pspm publish` shows a preview of included files and package size. Max package size is **10MB**.
 
 ### Managing Published Skills
 

package/dist/index.js

@@ -37,6 +37,9 @@ function getConfig() {
   }
   return config;
 }
+function isConfigured() {
+  return config !== null;
+}
 async function customFetch(url, options) {
   const { baseUrl, apiKey } = getConfig();
   const fullUrl = `${baseUrl}${url}`;
@@ -66,18 +69,42 @@ async function customFetch(url, options) {
     headers: response.headers
   };
 }
-var config;
+var config, SDKError;
 var init_fetcher = __esm({
   "src/sdk/fetcher.ts"() {
     config = null;
+    SDKError = class extends Error {
+      constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = "SDKError";
+      }
+    };
   }
 });
 
 // src/sdk/generated/index.ts
-var getMeUrl, me, getExplorePublicSkillsUrl, explorePublicSkills, getDeleteSkillUrl, deleteSkill, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getDeleteSkillVersionUrl, deleteSkillVersion, getPublishSkillUrl, publishSkill;
+var getExchangeCliTokenUrl, exchangeCliToken, getMeUrl, me, getExplorePublicSkillsUrl, explorePublicSkills, getListMySkillsUrl, listMySkills, getListUserSkillsUrl, listUserSkills, getGetSkillUrl, getSkill, getDeleteSkillUrl, deleteSkill, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getDeleteSkillVersionUrl, deleteSkillVersion, getPublishSkillUrl, publishSkill, getListOrgSkillVersionsUrl, listOrgSkillVersions, getGetOrgSkillVersionUrl, getOrgSkillVersion, getPublishOrgSkillUrl, publishOrgSkill;
 var init_generated = __esm({
   "src/sdk/generated/index.ts"() {
     init_fetcher();
+    getExchangeCliTokenUrl = () => {
+      return `/api/api-keys/cli-token-exchange`;
+    };
+    exchangeCliToken = async (exchangeCliTokenInput, options) => {
+      return customFetch(
+        getExchangeCliTokenUrl(),
+        {
+          ...options,
+          method: "POST",
+          headers: { "Content-Type": "application/json", ...options?.headers },
+          body: JSON.stringify(
+            exchangeCliTokenInput
+          )
+        }
+      );
+    };
     getMeUrl = () => {
       return `/api/skills/-/me`;
     };
@@ -109,6 +136,42 @@ var init_generated = __esm({
         }
       );
     };
+    getListMySkillsUrl = () => {
+      return `/api/skills/-/mine`;
+    };
+    listMySkills = async (options) => {
+      return customFetch(
+        getListMySkillsUrl(),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
+    };
+    getListUserSkillsUrl = (username) => {
+      return `/api/skills/@user/${username}`;
+    };
+    listUserSkills = async (username, options) => {
+      return customFetch(
+        getListUserSkillsUrl(username),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
+    };
+    getGetSkillUrl = (username, name) => {
+      return `/api/skills/@user/${username}/${name}`;
+    };
+    getSkill = async (username, name, options) => {
+      return customFetch(
+        getGetSkillUrl(username, name),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
+    };
     getDeleteSkillUrl = (username, name) => {
       return `/api/skills/@user/${username}/${name}`;
     };
@@ -173,10 +236,77 @@ var init_generated = __esm({
         }
       );
     };
+    getListOrgSkillVersionsUrl = (orgname, name) => {
+      return `/api/skills/@org/${orgname}/${name}/versions`;
+    };
+    listOrgSkillVersions = async (orgname, name, options) => {
+      return customFetch(
+        getListOrgSkillVersionsUrl(orgname, name),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
+    };
+    getGetOrgSkillVersionUrl = (orgname, name, version3) => {
+      return `/api/skills/@org/${orgname}/${name}/versions/${version3}`;
+    };
+    getOrgSkillVersion = async (orgname, name, version3, options) => {
+      return customFetch(
+        getGetOrgSkillVersionUrl(orgname, name, version3),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
+    };
+    getPublishOrgSkillUrl = (orgname) => {
+      return `/api/skills/@org/${orgname}/publish`;
+    };
+    publishOrgSkill = async (orgname, publishSkillInput, options) => {
+      return customFetch(
+        getPublishOrgSkillUrl(orgname),
+        {
+          ...options,
+          method: "POST",
+          headers: { "Content-Type": "application/json", ...options?.headers },
+          body: JSON.stringify(
+            publishSkillInput
+          )
+        }
+      );
+    };
   }
 });
 
 // src/api-client.ts
+var api_client_exports = {};
+__export(api_client_exports, {
+  SDKError: () => SDKError,
+  changeSkillAccess: () => changeSkillAccess,
+  configure: () => configure2,
+  deleteSkill: () => deleteSkill,
+  deleteSkillVersion: () => deleteSkillVersion,
+  deprecateSkillVersion: () => deprecateSkillVersion,
+  exchangeCliToken: () => exchangeCliToken,
+  fetchSkillList: () => fetchSkillList,
+  getConfig: () => getConfig,
+  getGithubSkillVersion: () => getGithubSkillVersion,
+  getOrgSkillVersion: () => getOrgSkillVersion,
+  getSkill: () => getSkill,
+  getSkillVersion: () => getSkillVersion,
+  isConfigured: () => isConfigured,
+  listGithubSkillVersions: () => listGithubSkillVersions,
+  listMySkills: () => listMySkills,
+  listOrgSkillVersions: () => listOrgSkillVersions,
+  listSkillVersions: () => listSkillVersions,
+  listUserSkills: () => listUserSkills,
+  me: () => me,
+  publishOrgSkill: () => publishOrgSkill,
+  publishSkill: () => publishSkill,
+  undeprecateSkillVersion: () => undeprecateSkillVersion,
+  whoamiRequest: () => whoamiRequest
+});
 function registryUrlToBaseUrl(registryUrl) {
   return registryUrl.replace(/\/api\/skills\/?$/, "");
 }
@@ -258,6 +388,32 @@ async function undeprecateSkillVersion(username, skillName, version3) {
     };
   }
 }
+async function fetchSkillList(ownerType, ownerName, listName) {
+  const config2 = getConfig();
+  try {
+    const response = await fetch(
+      `${config2.baseUrl}/api/skill-lists/lists/@${ownerType}/${ownerName}/${listName}`,
+      {
+        method: "GET",
+        headers: {
+          "Content-Type": "application/json",
+          ...config2.apiKey ? { Authorization: `Bearer ${config2.apiKey}` } : {}
+        }
+      }
+    );
+    if (!response.ok) {
+      const error = await response.text();
+      return { status: response.status, error };
+    }
+    const data = await response.json();
+    return { status: response.status, data };
+  } catch (error) {
+    return {
+      status: 500,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
 async function listGithubSkillVersions(owner, repo, name) {
   const config2 = getConfig();
   try {
@@ -1020,6 +1176,10 @@ async function resolveRecursive(rootDeps, config2) {
         );
         versionsStatus = resp.status;
         versionsData = resp.data;
+      } else if (parsed.namespace === "org") {
+        const resp = await listOrgSkillVersions(parsed.owner, parsed.name);
+        versionsStatus = resp.status;
+        versionsData = resp.status === 200 ? resp.data : void 0;
       } else {
         const resp = await listSkillVersions(parsed.owner, parsed.name);
         versionsStatus = resp.status;
@@ -1065,6 +1225,15 @@ async function resolveRecursive(rootDeps, config2) {
         if (resp.status === 200 && resp.data) {
           versionData = resp.data;
         }
+      } else if (parsed.namespace === "org") {
+        const resp = await getOrgSkillVersion(
+          parsed.owner,
+          parsed.name,
+          resolvedVersion
+        );
+        if (resp.status === 200 && resp.data) {
+          versionData = resp.data;
+        }
       } else {
         const resp = await getSkillVersion(
           parsed.owner,
@@ -1133,6 +1302,9 @@ async function resolveRecursive(rootDeps, config2) {
           p2Parsed.subname
         );
         p2Versions = resp.status === 200 ? resp.data : void 0;
+      } else if (p2Parsed.namespace === "org") {
+        const resp = await listOrgSkillVersions(p2Parsed.owner, p2Parsed.name);
+        p2Versions = resp.status === 200 ? resp.data : void 0;
       } else {
         const resp = await listSkillVersions(p2Parsed.owner, p2Parsed.name);
         p2Versions = resp.status === 200 ? resp.data : void 0;
@@ -1168,6 +1340,15 @@ async function resolveRecursive(rootDeps, config2) {
           if (resp.status === 200 && resp.data) {
             p2VersionData = resp.data;
           }
+        } else if (p2Parsed.namespace === "org") {
+          const resp = await getOrgSkillVersion(
+            p2Parsed.owner,
+            p2Parsed.name,
+            finalVersion
+          );
+          if (resp.status === 200 && resp.data) {
+            p2VersionData = resp.data;
+          }
         } else {
           const resp = await getSkillVersion(
             p2Parsed.owner,
@@ -3886,6 +4067,22 @@ async function install(specifiers, options) {
     const { setGlobalMode: setGlobalMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));
     setGlobalMode2(true);
   }
+  if (options.list) {
+    const listSpecifiers = await resolveListToSpecifiers(options.list);
+    if (listSpecifiers.length === 0) {
+      console.log("No skills in the list to install.");
+      return;
+    }
+    const allSpecifiers = [...specifiers, ...listSpecifiers];
+    const { add: add2 } = await Promise.resolve().then(() => (init_add(), add_exports));
+    await add2(allSpecifiers, {
+      save: true,
+      agent: options.agent,
+      yes: options.yes,
+      global: options.global
+    });
+    return;
+  }
   if (specifiers.length > 0) {
     const { add: add2 } = await Promise.resolve().then(() => (init_add(), add_exports));
     await add2(specifiers, {
@@ -3898,6 +4095,52 @@ async function install(specifiers, options) {
   }
   await installFromLockfile(options);
 }
+async function resolveListToSpecifiers(listSpec) {
+  const match = listSpec.match(/^@(user|org)\/([^/]+)\/([^/]+)$/);
+  if (!match) {
+    console.error(
+      `Error: Invalid list specifier "${listSpec}". Use format: @user/{username}/{list-name} or @org/{orgname}/{list-name}`
+    );
+    process.exit(1);
+  }
+  const [, ownerType, ownerName, listName] = match;
+  const config2 = await resolveConfig();
+  configure2({
+    registryUrl: config2.registryUrl,
+    apiKey: getTokenForRegistry(config2, config2.registryUrl)
+  });
+  console.log(
+    `Fetching skill list @${ownerType}/${ownerName}/${listName}...
+`
+  );
+  const { fetchSkillList: fetchSkillList2 } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
+  const response = await fetchSkillList2(
+    ownerType,
+    ownerName,
+    listName
+  );
+  if (response.status !== 200 || !response.data) {
+    const errorMsg = response.status === 404 ? `List "@${ownerType}/${ownerName}/${listName}" not found or is private.` : response.error || "Failed to fetch list";
+    console.error(`Error: ${errorMsg}`);
+    process.exit(1);
+  }
+  const list2 = response.data;
+  console.log(
+    `List: ${list2.name}${list2.description ? ` \u2014 ${list2.description}` : ""}`
+  );
+  console.log(`Skills: ${list2.items.length}
+`);
+  const specifiers = [];
+  for (const item of list2.items) {
+    const ns = item.namespace === "org" ? "org" : "user";
+    let spec = `@${ns}/${item.ownerName}/${item.skillName}`;
+    if (item.pinnedVersion) {
+      spec += `@${item.pinnedVersion}`;
+    }
+    specifiers.push(spec);
+  }
+  return specifiers;
+}
 async function installFromLockfile(options) {
   try {
     const config2 = await resolveConfig();
@@ -5348,13 +5591,25 @@ async function publishCommand(options) {
       console.log("");
       console.log(`pspm notice Publishing to ${registryUrl} with tag latest`);
       configure2({ registryUrl, apiKey });
-      const response = await publishSkill({
-        manifest: packageJson2,
-        tarballBase64,
-        visibility: options.access
-      });
+      let response;
+      if (options.org) {
+        response = await publishOrgSkill(options.org, {
+          manifest: packageJson2,
+          tarballBase64,
+          visibility: options.access
+        });
+      } else {
+        response = await publishSkill({
+          manifest: packageJson2,
+          tarballBase64,
+          visibility: options.access
+        });
+      }
       if (response.status !== 200) {
-        const errorMessage = extractApiErrorMessage(response, "Publish failed");
+        const errorMessage = extractApiErrorMessage(
+          { status: response.status, data: response.data },
+          "Publish failed"
+        );
         if (errorMessage.includes("must be greater than") || errorMessage.includes("already exists")) {
           console.error("pspm error code E403");
           console.error(
@@ -5365,9 +5620,11 @@ async function publishCommand(options) {
       }
       const result = response.data;
       const visibility = result.skill.visibility;
-      const visibilityIcon = visibility === "public" ? "\u{1F310}" : "\u{1F512}";
+      const visibilityIcon = visibility === "public" ? "\u{1F310}" : visibility === "team" ? "\u{1F465}" : "\u{1F512}";
+      const namespace = options.org ? "org" : result.skill.namespace ?? "user";
+      const owner = options.org ?? result.skill.username;
       console.log(
-        `+ @${result.skill.namespace ?? "user"}/${result.skill.username}/${result.skill.name}@${result.version.version}`
+        `+ @${namespace}/${owner}/${result.skill.name}@${result.version.version}`
       );
       console.log(`Checksum: ${result.version.checksum}`);
       console.log(`Visibility: ${visibilityIcon} ${visibility}`);
@@ -6021,11 +6278,15 @@ program.command("install [specifiers...]").alias("i").description(
 ).option("--frozen-lockfile", "Fail if lockfile is missing or outdated").option("--dir <path>", "Install skills to a specific directory").option(
   "--agent <agents>",
   'Comma-separated agents for symlinks (default: all agents, use "none" to skip)'
+).option(
+  "--list <specifier>",
+  "Install all skills from a skill list (e.g. @user/username/list-name)"
 ).option("-g, --global", "Install to user home directory instead of project").option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (specifiers, options) => {
   await install(specifiers, {
     frozenLockfile: options.frozenLockfile,
     dir: options.dir,
     agent: options.agent,
+    list: options.list,
     yes: options.yes,
     global: options.global
   });
@@ -6070,19 +6331,24 @@ program.command("version <bump>").description("Bump package version (major, mino
     dryRun: options.dryRun
   });
 });
-program.command("publish").description("Publish current directory as a skill").option("--bump <level>", "Bump version (major, minor, patch)").option("--tag <tag>", "Tag for the release").requiredOption(
+program.command("publish").description("Publish current directory as a skill").option("--bump <level>", "Bump version (major, minor, patch)").option("--tag <tag>", "Tag for the release").option("--org <orgname>", "Publish under an organization namespace").requiredOption(
   "--access <level>",
-  "Set package visibility (public or private)"
+  "Set package visibility (public, private, or team)"
 ).action(async (options) => {
   const access3 = options.access;
-  if (access3 !== "public" && access3 !== "private") {
-    console.error('Error: --access must be "public" or "private"');
+  if (access3 !== "public" && access3 !== "private" && access3 !== "team") {
+    console.error('Error: --access must be "public", "private", or "team"');
+    process.exit(1);
+  }
+  if (access3 === "team" && !options.org) {
+    console.error("Error: --access team requires --org <orgname>");
     process.exit(1);
   }
   await publishCommand({
     bump: options.bump,
     tag: options.tag,
-    access: access3
+    access: access3,
+    org: options.org
   });
 });
 program.command("unpublish <specifier>").description(