@bobfrankston/npmglobalize 1.0.145 → 1.0.147

package/README.md

@@ -86,6 +86,14 @@ npmglobalize
 npmglobalize -npd         # --no-publish-deps
 ```
 
+### 🔍 Prescan (Default)
+
+Before any transform/publish, `npmglobalize` walks the full `file:` dep graph and reports all problems up front (unresolvable paths, missing `package.json`, unscoped packages with private intent, etc.). This lets you fix the whole punch list at once rather than being interrupted mid-cascade.
+
+Errors abort (unless `--force`); warnings prompt to continue.
+
+Skip the prescan with `-no-prescan` / `-nps`.
+
 **Force republish** all file: dependencies even if versions exist:
 ```bash
 npmglobalize --force-publish
@@ -264,7 +272,10 @@ Publishing requires being on a branch so commits and tags can be properly tracke
 ```
 -update-deps, -ud        Update package.json to latest versions (safe: minor/patch)
 -update-major            Allow major version updates (breaking changes)
+-publish-deps            Auto-publish file: dependencies (default)
+-pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only)
 -no-publish-deps, -npd   Skip auto-publishing file: dependencies
+-no-prescan, -nps        Skip upfront dep-graph prescan
 -force-publish           Republish dependencies even if version exists
 -fix                     Run npm audit fix after transformation
 -no-fix                  Don't run npm audit

package/cli.js

@@ -31,7 +31,10 @@ Release Options:
 Dependency Options:
   -update-deps, -ud        Update package.json to latest (minor/patch only, safe)
   -update-major            Allow major version updates (breaking changes)
+  -publish-deps            Auto-publish file: dependencies (default)
+  -pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only)
   -no-publish-deps, -npd   Don't auto-publish file: dependencies (use with caution)
+  -no-prescan, -nps        Skip upfront dep-graph prescan
   -force-publish           Republish dependencies even if version exists
   -fix                     Run npm audit fix after transformation
 
@@ -251,10 +254,18 @@ function parseArgs(args) {
             case '-publish-deps':
                 options.publishDeps = true; // Explicitly enable (though it's default)
                 break;
+            case '-pd':
+                options.publishDeps = true;
+                options.publishDepsYes = true; // Auto-yes to dep-cascade prompts (private only)
+                break;
             case '-no-publish-deps':
             case '-npd':
                 options.publishDeps = false; // Disable auto-publishing
                 break;
+            case '-no-prescan':
+            case '-nps':
+                options.noPrescan = true;
+                break;
             case '-force-publish':
                 options.forcePublish = true;
                 break;

package/lib/types.d.ts

@@ -52,6 +52,10 @@ export interface GlobalizeOptions {
     updateMajor?: boolean;
     /** Publish file: dependencies before converting them */
     publishDeps?: boolean;
+    /** Auto-yes to dep-cascade prompts (add scope for private); does NOT auto-yes public prompts */
+    publishDepsYes?: boolean;
+    /** Skip the upfront dep-graph prescan */
+    noPrescan?: boolean;
     /** Force republish dependencies even if version exists on npm */
     forcePublish?: boolean;
     /** Run npm audit and fix vulnerabilities */

package/lib.d.ts

@@ -67,6 +67,8 @@ export interface GlobalizeOptions {
     updateMajor?: boolean;
     /** Publish file: dependencies before converting them */
     publishDeps?: boolean;
+    /** Auto-yes to dep-cascade prompts (add scope to make private, etc.); does NOT auto-yes public prompts */
+    publishDepsYes?: boolean;
     /** Force republish dependencies even if version exists on npm */
     forcePublish?: boolean;
     /** Run npm audit and fix vulnerabilities */
@@ -96,6 +98,10 @@ export interface GlobalizeOptions {
     /** Internal: auto-initialize git repos without prompting (user chose "all") */
     autoInit?: boolean;
     /** Internal: signals this call is from workspace orchestrator */
+    /** Skip the upfront dep-graph prescan */
+    noPrescan?: boolean;
+    /** Internal: recursive dep-cascade call (suppresses prescan + banner) */
+    _fromDep?: boolean;
     _fromWorkspace?: boolean;
     /** Internal: signals this call is from CLI (version already printed) */
     _fromCli?: boolean;
@@ -190,6 +196,19 @@ export declare function transformDeps(pkg: any, baseDir: string, verbose?: boole
         path: string;
     }>;
 };
+/** A problem discovered by the prescan. */
+export interface PrescanIssue {
+    severity: 'error' | 'warning';
+    package: string;
+    path: string;
+    message: string;
+    suggestion?: string;
+}
+/** Walk the full file: dep graph and collect issues up front — missing scopes,
+ *  unresolvable paths, missing package.json, unpublished transitives. Lets the
+ *  user resolve all problems before starting the publish cascade instead of
+ *  being interrupted mid-run. */
+export declare function prescanDepGraph(baseDir: string, visited?: Set<string>, verbose?: boolean): PrescanIssue[];
 /** Restore file: dependencies from .dependencies using a three-way merge that
  *  preserves any external modifications made since the last transform. */
 export declare function restoreDeps(pkg: any, verbose?: boolean): boolean;

package/lib.js

@@ -986,6 +986,83 @@ function printDepTree(baseDir, indent = 0, visited = new Set()) {
         }
     }
 }
+/** Walk the full file: dep graph and collect issues up front — missing scopes,
+ *  unresolvable paths, missing package.json, unpublished transitives. Lets the
+ *  user resolve all problems before starting the publish cascade instead of
+ *  being interrupted mid-run. */
+export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
+    const issues = [];
+    let realDir;
+    try {
+        realDir = fs.realpathSync(baseDir);
+    }
+    catch {
+        return issues;
+    }
+    if (visited.has(realDir))
+        return issues;
+    visited.add(realDir);
+    let pkg;
+    try {
+        pkg = readPackageJson(baseDir);
+    }
+    catch {
+        return issues;
+    }
+    for (const key of DEP_KEYS) {
+        if (!pkg[key])
+            continue;
+        const deps = pkg['.' + key] || pkg[key];
+        for (const [name, value] of Object.entries(deps)) {
+            if (!isFileRef(value))
+                continue;
+            let targetPath;
+            try {
+                targetPath = resolveFilePath(value, baseDir);
+            }
+            catch {
+                issues.push({ severity: 'error', package: name, path: value, message: 'unresolvable file: path' });
+                continue;
+            }
+            if (!fs.existsSync(targetPath)) {
+                issues.push({
+                    severity: 'error', package: name, path: targetPath,
+                    message: `file: target does not exist`,
+                    suggestion: `check that "${value}" is the correct relative path`
+                });
+                continue;
+            }
+            let targetPkg;
+            try {
+                targetPkg = readPackageJson(targetPath);
+            }
+            catch {
+                issues.push({ severity: 'error', package: name, path: targetPath, message: 'no package.json at file: target' });
+                continue;
+            }
+            const depName = targetPkg.name || name;
+            // Unscoped + private-intent: will trigger a mid-cascade scope prompt
+            if (!depName.startsWith('@')) {
+                const depConfig = readConfig(targetPath);
+                const depVis = depConfig.npmVisibility
+                    ?? (targetPkg.publishConfig?.access === 'public' ? 'public' : undefined);
+                const noprefix = depConfig.noprefix === true;
+                if (depVis !== 'public' && !noprefix) {
+                    issues.push({
+                        severity: 'warning',
+                        package: depName,
+                        path: targetPath,
+                        message: 'unscoped package — private publishing will prompt for a scope',
+                        suggestion: 'add a scope (e.g., @bobfrankston/) OR set npmVisibility="public" OR set noprefix=true in .globalize.json5'
+                    });
+                }
+            }
+            // Recurse into the dep
+            issues.push(...prescanDepGraph(targetPath, visited, verbose));
+        }
+    }
+    return issues;
+}
 /** Restore file: dependencies from .dependencies using a three-way merge that
  *  preserves any external modifications made since the last transform. */
 export function restoreDeps(pkg, verbose = false) {
@@ -2462,7 +2539,8 @@ async function doLocalInstall(cwd, options) {
 }
 export async function globalize(cwd, options = {}, configOptions = {}) {
     const { bump = 'patch', noPublish = false, cleanup = false, install = false, link = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'private', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
-    forcePublish = false, fix = true, fixTags = false, rebase = false, show = false, local = false, freeze = false } = options;
+    publishDepsYes = false, // -pd: auto-yes to dep-cascade prompts (private only)
+    noPrescan = false, forcePublish = false, fix = true, fixTags = false, rebase = false, show = false, local = false, freeze = false } = options;
     // Show tool version only for recursive dep calls (CLI already prints it at startup)
     const toolVersion = getToolVersion();
     if (!options._fromWorkspace && !options._fromCli) {
@@ -2568,6 +2646,37 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         }
         return true;
     }
+    // Prescan the file: dep graph up front — surface all problems before
+    // any transform/publish, so the user can fix them once and run clean.
+    // Only run at the top level (not during recursive cascade or workspace).
+    if (!noPrescan && !cleanup && !options._fromDep && !options._fromWorkspace) {
+        const issues = prescanDepGraph(cwd, new Set(), verbose);
+        if (issues.length > 0) {
+            const errors = issues.filter(i => i.severity === 'error');
+            const warnings = issues.filter(i => i.severity === 'warning');
+            console.log(colors.yellow(`Prescan found ${issues.length} issue(s) in the file: dep graph:`));
+            for (const i of issues) {
+                const tag = i.severity === 'error' ? colors.red('ERROR') : colors.yellow('WARN');
+                console.log(`  ${tag} ${i.package}: ${i.message}`);
+                console.log(colors.dim(`       at ${i.path}`));
+                if (i.suggestion)
+                    console.log(colors.dim(`       → ${i.suggestion}`));
+            }
+            console.log('');
+            if (errors.length > 0 && !force) {
+                console.error(colors.red(`Prescan aborted: ${errors.length} error(s). Fix them or rerun with --force.`));
+                return false;
+            }
+            if (warnings.length > 0 && !force && !publishDepsYes) {
+                const ok = await confirm('Continue despite prescan warnings?', false);
+                if (!ok)
+                    return false;
+            }
+        }
+        else if (verbose) {
+            console.log(colors.dim('Prescan: no issues found in dep graph.'));
+        }
+    }
     // Check ignore files first (unless cleanup mode)
     if (!cleanup && !asis) {
         const checkResult = checkIgnoreFiles(cwd, { conform, asis, verbose });
@@ -3263,7 +3372,9 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                             fix,
                             conform, // Propagate conform to dependencies
                             publishDeps, // Propagate so transitive deps also get published
+                            publishDepsYes, // Propagate auto-yes through cascade
                             forcePublish, // Propagate so transitive deps get force-published too
+                            _fromDep: true, // Suppress nested prescan
                             rebase, // Propagate so behind-remote deps get rebased automatically
                             autoInit: options.autoInit // Propagate "init all" choice
                         });
@@ -3289,7 +3400,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log(colors.yellow('  3. Use --force to continue anyway (NOT RECOMMENDED)'));
                 console.log(colors.yellow('  4. Use -npd (--no-publish-deps) to skip dependency publishing'));
                 console.log('');
-                if (!force) {
+                if (!force && !publishDepsYes) {
                     const shouldContinue = await confirm('Continue with unpublished dependencies?', false);
                     if (!shouldContinue) {
                         return false;
@@ -3561,17 +3672,11 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                                     console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
                                 }
                                 else {
-                                    // Registry install failed — fall back to local install
+                                    // Registry install failed — check if it's an auth issue
                                     const auth = checkNpmAuth();
                                     if (!auth.authenticated) {
-                                        console.log(colors.yellow(`  Registry install failed (${auth.error || 'auth issue'}) — falling back to local install...`));
-                                    }
-                                    else {
-                                        console.log(colors.yellow(`  Registry install failed — falling back to local install...`));
-                                    }
-                                    const localFallback = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
-                                    if (localFallback.success) {
-                                        console.log(colors.green(`✓ Installed globally from local: ${pkgName}@${pkgVersion}`));
+                                        console.error(colors.red(`  Registry install failed — npm auth problem: ${auth.error || 'unknown'}`));
+                                        console.error(colors.yellow(`  Run 'npm login' to fix, then: npm install -g ${pkgName}@${pkgVersion}`));
                                     }
                                     else {
                                         console.error(colors.red(`✗ Global install failed`));
@@ -4280,19 +4385,12 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                         console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
                     }
                     else {
-                        // Registry install failed — may be auth/token issue for private packages.
-                        // Fall back to local install which doesn't need registry auth.
+                        // Registry install failed — check if it's an auth issue
                         const auth = checkNpmAuth();
                         if (!auth.authenticated) {
-                            console.log(colors.yellow(`  Registry install failed (${auth.error || 'auth issue'}) — falling back to local install...`));
-                        }
-                        else {
-                            console.log(colors.yellow(`  Registry install failed — falling back to local install...`));
-                        }
-                        const localFallback = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
-                        if (localFallback.success) {
-                            globalInstallOk = true;
-                            console.log(colors.green(`✓ Installed globally from local: ${pkgName}@${pkgVersion}`));
+                            console.error(colors.red(`✗ Global install failed — npm auth problem: ${auth.error || 'unknown'}`));
+                            console.error(colors.yellow(`  Run 'npm login' to fix, then: npm install -g ${pkgName}@${pkgVersion}`));
+                            recordBuildIssue(pkgName, 'warning', `Global install failed (${auth.error || 'auth issue'}) — run 'npm login'`);
                         }
                         else {
                             console.error(colors.red(`✗ Global install failed`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.145",
+  "version": "1.0.147",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",