@bobfrankston/npmglobalize 1.0.152 → 1.0.154

package/README.md

@@ -350,6 +350,11 @@ Workspace mode is auto-detected when run from a root with `"private": true` and
 -asis           Skip ignore file checks (or set "asis": true in .globalize.json5)
 -fix-tags       Automatically fix version/tag mismatches
 -rebase         Automatically rebase if local is behind remote
+-clean-nested-modules, -clean-nested
+                Before npm pack, wipe node_modules/ inside each file: dep
+                target. Fixes arborist "Cannot read properties of null"
+                crashes caused by sibling file: deps with nested
+                node_modules. Suggested automatically when the error hits.
 -show           Show package.json dependency changes
 -package, -pkg  Update package.json scripts to use npmglobalize (see below)
 -h, -help       Show help

package/cli.js

@@ -2,7 +2,7 @@
 /**
  * npmglobalize CLI - Transform file: dependencies to npm versions for publishing
  */
-import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, confirm, getBuildIssues, clearBuildIssues, recordBuildIssue, extractFirstTscError } from './lib.js';
+import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, confirm, getBuildIssues, clearBuildIssues, recordBuildIssue, extractFirstTscError, ensureFileDepModules } from './lib.js';
 import fs from 'fs';
 import path from 'path';
 import { styleText } from 'util';
@@ -423,6 +423,7 @@ export async function main() {
                 }
             }
             if (pkg.scripts?.build) {
+                ensureFileDepModules(cwd, !!cliOptions.verbose);
                 const { spawnSync } = await import('child_process');
                 console.log(`Building ${cwd}...`);
                 const buildResult = spawnSync('npm', ['run', 'build'], {

package/lib.d.ts

@@ -234,6 +234,12 @@ export declare function parseVersionTag(tag: string): number[] | null;
 export declare function compareVersions(a: number[], b: number[]): number;
 /** Fix version/tag mismatches */
 export declare function fixVersionTagMismatch(cwd: string, pkg: any, verbose?: boolean): boolean;
+/** Walk `file:` deps transitively and run `npm install` in any target whose
+ *  package.json declares deps but has no `node_modules/`. Recovers from prior
+ *  aborted runs (or pre-1.0.153 `--clean-nested-modules` damage) so the
+ *  upcoming build/pack can resolve transitive package imports.
+ *  Cycle-safe via the shared `visited` set. */
+export declare function ensureFileDepModules(cwd: string, verbose?: boolean, visited?: Set<string>): void;
 /** Run a command and return success status */
 export declare function runCommand(cmd: string, args: string[], options?: {
     silent?: boolean;

package/lib.js

@@ -1262,12 +1262,10 @@ function waitForNpmVersion(pkgName, version, maxWaitMs = 90000) {
     process.stdout.write(' timed out\n');
     return false;
 }
-/** Delete `node_modules/` inside each `file:` dep target.
- *  Works around arborist crashes during `npm pack` when sibling `file:` deps
- *  have their own populated `node_modules/`. Returns the names of cleaned deps. */
 function cleanNestedDepModules(pkg, cwd, verbose) {
-    const cleaned = [];
+    const stashed = [];
     const seen = new Set();
+    const suffix = `.npmglobalize-stash-${process.pid}`;
     for (const key of ['.dependencies', '.devDependencies', 'dependencies', 'devDependencies']) {
         const deps = pkg?.[key];
         if (!deps || typeof deps !== 'object')
@@ -1282,18 +1280,90 @@ function cleanNestedDepModules(pkg, cwd, verbose) {
             if (!fs.existsSync(nm))
                 continue;
             seen.add(name);
+            const backup = nm + suffix;
             try {
-                fs.rmSync(nm, { recursive: true, force: true });
-                cleaned.push(name);
+                if (fs.existsSync(backup))
+                    fs.rmSync(backup, { recursive: true, force: true });
+                fs.renameSync(nm, backup);
+                stashed.push({ name, nm, backup });
                 if (verbose)
-                    console.log(colors.dim(`  cleaned ${nm}`));
+                    console.log(colors.dim(`  stashed ${nm} -> ${path.basename(backup)}`));
             }
             catch (e) {
-                console.error(colors.yellow(`  warning: could not clean ${nm}: ${e.message}`));
+                console.error(colors.yellow(`  warning: could not stash ${nm}: ${e.message}`));
             }
         }
     }
-    return cleaned;
+    return stashed;
+}
+/** Restore `node_modules/` previously moved aside by `cleanNestedDepModules`.
+ *  Safe to call multiple times; missing backups are skipped. */
+function restoreNestedDepModules(stashed, verbose) {
+    for (const s of stashed) {
+        try {
+            if (!fs.existsSync(s.backup))
+                continue;
+            if (fs.existsSync(s.nm))
+                fs.rmSync(s.nm, { recursive: true, force: true });
+            fs.renameSync(s.backup, s.nm);
+            if (verbose)
+                console.log(colors.dim(`  restored ${s.nm}`));
+        }
+        catch (e) {
+            console.error(colors.yellow(`  warning: could not restore ${s.nm}: ${e.message}`));
+            console.error(colors.yellow(`    backup remains at ${s.backup} — restore manually`));
+        }
+    }
+}
+/** Walk `file:` deps transitively and run `npm install` in any target whose
+ *  package.json declares deps but has no `node_modules/`. Recovers from prior
+ *  aborted runs (or pre-1.0.153 `--clean-nested-modules` damage) so the
+ *  upcoming build/pack can resolve transitive package imports.
+ *  Cycle-safe via the shared `visited` set. */
+export function ensureFileDepModules(cwd, verbose = false, visited = new Set()) {
+    const abs = path.resolve(cwd);
+    if (visited.has(abs))
+        return;
+    visited.add(abs);
+    let pkg;
+    try {
+        pkg = readPackageJson(cwd);
+    }
+    catch {
+        return;
+    }
+    for (const key of ['dependencies', 'devDependencies']) {
+        const deps = pkg?.[key];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [name, spec] of Object.entries(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const target = path.resolve(cwd, spec.slice('file:'.length));
+            if (!fs.existsSync(path.join(target, 'package.json')))
+                continue;
+            let targetPkg;
+            try {
+                targetPkg = readPackageJson(target);
+            }
+            catch {
+                continue;
+            }
+            const hasDeps = (targetPkg?.dependencies && Object.keys(targetPkg.dependencies).length > 0) ||
+                (targetPkg?.devDependencies && Object.keys(targetPkg.devDependencies).length > 0);
+            const nm = path.join(target, 'node_modules');
+            if (hasDeps && !fs.existsSync(nm)) {
+                console.log(colors.yellow(`↻ restoring node_modules in ${name} (${target})`));
+                const r = runCommand('npm', ['install'], { cwd: target, silent: !verbose });
+                if (!r.success) {
+                    console.error(colors.red(`  ✗ npm install failed in ${target}`));
+                    if (r.stderr)
+                        console.error(colors.dim(r.stderr.split('\n').slice(0, 5).join('\n')));
+                }
+            }
+            ensureFileDepModules(target, verbose, visited);
+        }
+    }
 }
 /** Run npm install -g with retries for registry propagation delay */
 function installGlobalWithRetry(pkgSpec, cwd, maxRetries = 3) {
@@ -3041,6 +3111,8 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     const pkg = readPackageJson(cwd);
     // Run build step if package.json has a build script (skip if CLI already built)
     if (pkg.scripts?.build && !options._fromCli) {
+        if (!dryRun)
+            ensureFileDepModules(cwd, verbose);
         console.log(`${timestamp()} Running build...`);
         if (!dryRun) {
             // Always capture output so we can extract tsc errors for the summary
@@ -4270,11 +4342,14 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (verbose) {
             console.log(colors.green(`✓ Authenticated as ${authStatus.username}`));
         }
-        // Optionally clean nested node_modules in file: dep targets before pack
+        // Optionally stash nested node_modules in file: dep targets before pack
+        // (arborist crashes when sibling file: deps have populated node_modules).
+        // Restored immediately after pack so symlinked file: deps stay runnable.
+        let stashedDepModules = [];
         if (options.cleanNestedModules) {
-            const cleaned = cleanNestedDepModules(pkg, cwd, verbose);
-            if (cleaned.length > 0) {
-                console.log(colors.yellow(`  Cleaned node_modules in ${cleaned.length} file: dep target(s): ${cleaned.join(', ')}`));
+            stashedDepModules = cleanNestedDepModules(pkg, cwd, verbose);
+            if (stashedDepModules.length > 0) {
+                console.log(colors.yellow(`  Cleaned node_modules in ${stashedDepModules.length} file: dep target(s): ${stashedDepModules.map(s => s.name).join(', ')}`));
             }
             else if (verbose) {
                 console.log(colors.dim('  --clean-nested-modules: nothing to clean'));
@@ -4282,6 +4357,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         }
         // Create tarball first
         const packResult = runCommand('npm', ['pack'], { cwd, silent: true });
+        // Restore stashed node_modules now that pack is done — must happen
+        // before any subsequent install -g symlinks to these dep targets.
+        if (stashedDepModules.length > 0)
+            restoreNestedDepModules(stashedDepModules, verbose);
         if (!packResult.success) {
             const d = diagnoseNpmPackFailure(cwd, packResult.output, packResult.stderr, pkg);
             console.error(colors.red(`ERROR: ${d.summary}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.152",
+  "version": "1.0.154",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -33,6 +33,7 @@
   "dependencies": {
     "@bobfrankston/freezepak": "^0.1.7",
     "@bobfrankston/importgen": "^0.1.34",
+    "@bobfrankston/npmglobalize": "^1.0.153",
     "@bobfrankston/themecolors": "^0.1.5",
     "@bobfrankston/userconfig": "^1.0.7",
     "@npmcli/package-json": "^7.0.4",
@@ -48,6 +49,7 @@
   ".dependencies": {
     "@bobfrankston/freezepak": "file:../freezepak",
     "@bobfrankston/importgen": "file:../importgen",
+    "@bobfrankston/npmglobalize": "^1.0.153",
     "@bobfrankston/themecolors": "file:../themecolors",
     "@bobfrankston/userconfig": "file:../userconfig",
     "@npmcli/package-json": "^7.0.4",
@@ -61,6 +63,7 @@
     "dependencies": {
       "@bobfrankston/freezepak": "^0.1.7",
       "@bobfrankston/importgen": "^0.1.34",
+      "@bobfrankston/npmglobalize": "^1.0.153",
       "@bobfrankston/themecolors": "^0.1.5",
       "@bobfrankston/userconfig": "^1.0.7",
       "@npmcli/package-json": "^7.0.4",