@bobfrankston/npmglobalize 1.0.169 → 1.0.170

package/cli.js

@@ -37,6 +37,12 @@ Dependency Options:
   -publish-deps            Auto-publish file: dependencies (default)
   -pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only)
   -no-publish-deps, -npd   Don't auto-publish file: dependencies (use with caution)
+  -public-deps             Cascade npmVisibility:"public" to all transitive workspace/file:
+                           deps. In workspace mode: auto-promotes every reachable workspace
+                           member without prompting (writes npmVisibility:"public" into each
+                           dep's .globalize.json5). In single-package mode: also propagates
+                           public visibility to already-published deps in the cascade.
+                           Use when a public consumer's deps weren't all marked public.
   -no-prescan, -nps        Skip upfront dep-graph prescan
   -force-publish           Republish dependencies even if version exists
   -fix                     Run npm audit fix after transformation
@@ -298,6 +304,9 @@ function parseArgs(args) {
             case '-npd':
                 options.publishDeps = false; // Disable auto-publishing
                 break;
+            case '-public-deps':
+                options.publicDeps = true;
+                break;
             case '-no-use-paths':
             case '-nup':
                 options.usePaths = false; // Skip sibling-path resolution; use latest npm version for file: deps

package/lib/config.js

@@ -65,7 +65,7 @@ export function writeConfig(dir, config, explicitKeys) {
     const existing = readConfig(dir);
     // Filter out temporary flags and default values (unless explicitly set)
     const filtered = {};
-    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'forcePublish', 'once', 'cleanNestedModules']);
+    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'publicDeps', 'forcePublish', 'once', 'cleanNestedModules']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
             continue;

package/lib/types.d.ts

@@ -54,6 +54,8 @@ export interface GlobalizeOptions {
     publishDeps?: boolean;
     /** Auto-yes to dep-cascade prompts (add scope for private); does NOT auto-yes public prompts */
     publishDepsYes?: boolean;
+    /** Cascade npmVisibility:"public" to all transitive workspace/file: deps without prompting. */
+    publicDeps?: boolean;
     /** Skip the upfront dep-graph prescan */
     noPrescan?: boolean;
     /** Force republish dependencies even if version exists on npm */

package/lib.d.ts

@@ -73,6 +73,12 @@ export interface GlobalizeOptions {
     publishDeps?: boolean;
     /** Auto-yes to dep-cascade prompts (add scope to make private, etc.); does NOT auto-yes public prompts */
     publishDepsYes?: boolean;
+    /** Cascade npmVisibility:"public" to all transitive workspace/file: deps without prompting.
+     *  In workspace mode: fixpoint-promotes every workspace member reachable from a public consumer.
+     *  In single-package mode: drops the "first publish only" guard so already-published deps also
+     *  get the parent's npmVisibility propagated. Use to fix a workspace where a public member's
+     *  deps weren't all marked public (and the published tarball would 404 on install). */
+    publicDeps?: boolean;
     /** Force republish dependencies even if version exists on npm */
     forcePublish?: boolean;
     /** Run npm audit and fix vulnerabilities */

package/lib.js

@@ -238,7 +238,7 @@ export function writeConfig(dir, config, explicitKeys) {
     const existing = readConfig(dir);
     // Filter out temporary flags and default values (unless explicitly set)
     const filtered = {};
-    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'forcePublish', 'once', 'cleanNestedModules']);
+    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'publicDeps', 'forcePublish', 'once', 'cleanNestedModules']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
             continue;
@@ -3108,6 +3108,7 @@ async function doLocalInstall(cwd, options) {
 export async function globalize(cwd, options = {}, configOptions = {}) {
     const { bump = 'patch', noPublish = false, cleanup = false, install = false, link = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'private', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
     publishDepsYes = false, // -pd: auto-yes to dep-cascade prompts (private only)
+    publicDeps = false, // -public-deps: cascade public visibility to all deps
     noPrescan = false, forcePublish = false, fix = true, fixTags = false, rebase = false, show = false, local = false, freeze = false, usePaths = true, allowTs } = options;
     // Show tool version only for recursive dep calls (CLI already prints it at startup)
     const toolVersion = getToolVersion();
@@ -3985,8 +3986,11 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     if (!dryRun) {
                         // Check if package has EVER been published to npm (any version)
                         const hasBeenPublished = checkPackageExists(name);
-                        // Recursively call globalize on the dependency
-                        // Only pass npmVisibility to truly NEW packages (never published before)
+                        // Recursively call globalize on the dependency.
+                        // Normally only pass npmVisibility to truly NEW packages (never published
+                        // before) — already-published deps keep their own visibility setting.
+                        // -public-deps overrides this: propagate npmVisibility regardless so a
+                        // public consumer's transitive deps all get promoted to public.
                         const depSuccess = await globalize(path, {
                             bump: 'patch', // Use existing version, don't bump
                             verbose,
@@ -3994,13 +3998,14 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                             force,
                             files,
                             gitVisibility,
-                            npmVisibility: hasBeenPublished ? undefined : npmVisibility, // Only for new packages
+                            npmVisibility: (hasBeenPublished && !publicDeps) ? undefined : npmVisibility,
                             updateDeps,
                             updateMajor,
                             fix,
                             conform, // Propagate conform to dependencies
                             publishDeps, // Propagate so transitive deps also get published
                             publishDepsYes, // Propagate auto-yes through cascade
+                            publicDeps, // Propagate so transitive deps also get promoted to public
                             forcePublish, // Propagate so transitive deps get force-published too
                             _fromDep: true, // Suppress nested prescan
                             rebase, // Propagate so behind-remote deps get rebased automatically
@@ -5364,32 +5369,109 @@ export async function globalizeWorkspace(rootDir, options = {}, configOptions =
         }
     }
     const wsNameSet = new Set(packages.map(p => p.name));
-    for (const pkgInfo of packages) {
-        if (visibilityMap.get(pkgInfo.name) !== 'public')
-            continue;
-        const deps = { ...pkgInfo.pkg.dependencies, ...pkgInfo.pkg.devDependencies };
-        for (const depName of Object.keys(deps || {})) {
-            if (!wsNameSet.has(depName))
-                continue;
-            if (visibilityMap.get(depName) === 'public')
+    // Fixpoint: each promotion can expose new transitive deps (a newly-public B may
+    // itself depend on a private C). Iterate until no further promotions happen so
+    // chains like public A → private B → private C are fully resolved regardless of
+    // packages[] order.
+    {
+        let changed = true;
+        let guard = 0;
+        while (changed && guard++ < 50) {
+            changed = false;
+            for (const pkgInfo of packages) {
+                if (visibilityMap.get(pkgInfo.name) !== 'public')
+                    continue;
+                const deps = { ...pkgInfo.pkg.dependencies, ...pkgInfo.pkg.devDependencies };
+                for (const depName of Object.keys(deps || {})) {
+                    if (!wsNameSet.has(depName))
+                        continue;
+                    if (visibilityMap.get(depName) === 'public')
+                        continue;
+                    const depInfo = packages.find(p => p.name === depName);
+                    if (!depInfo)
+                        continue;
+                    console.log(colors.yellow(`⚠ Public package ${pkgInfo.name} depends on ${depName} which has no public visibility set.`));
+                    let makePublic = false;
+                    if (options.publicDeps) {
+                        console.log(colors.green(`  -public-deps: auto-promoting ${depName} to public`));
+                        makePublic = true;
+                    }
+                    else if (options.dryRun) {
+                        console.log(colors.dim(`  [dry-run] Would ask to make ${depName} public`));
+                    }
+                    else {
+                        makePublic = await confirm(`Make ${depName} public too?`, true);
+                    }
+                    if (makePublic) {
+                        if (!options.dryRun) {
+                            const depConfig = readConfig(depInfo.dir);
+                            depConfig.npmVisibility = 'public';
+                            writeConfig(depInfo.dir, depConfig, new Set(['npmVisibility']));
+                            console.log(colors.green(`✓ Set ${depName} to public in .globalize.json5`));
+                        }
+                        else {
+                            console.log(colors.dim(`  [dry-run] Would set ${depName} npmVisibility:"public"`));
+                        }
+                        visibilityMap.set(depName, 'public');
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    // Fail-loud: refuse to publish a public workspace member whose file: deps point
+    // at non-publishable workspace siblings (private:true, noPublish:true, or still
+    // not marked public after the prompt loop). A registry tarball declaring such
+    // deps would 404 on a clean install. See docs/npmglobalize-transitive-workspace-deps.md.
+    {
+        const allMembers = resolveAllWorkspacePackages(rootDir);
+        const memberByName = new Map();
+        for (const m of allMembers)
+            memberByName.set(m.name, m);
+        const blockers = [];
+        const filteredSet = new Set(filteredOrder);
+        for (const pkgInfo of packages) {
+            if (visibilityMap.get(pkgInfo.name) !== 'public')
                 continue;
-            const depInfo = packages.find(p => p.name === depName);
-            if (!depInfo)
+            // Only check members that will actually be processed this run.
+            if (!filteredSet.has(pkgInfo.name))
                 continue;
-            console.log(colors.yellow(`⚠ Public package ${pkgInfo.name} depends on ${depName} which has no public visibility set.`));
-            if (!options.dryRun) {
-                const makePublic = await confirm(`Make ${depName} public too?`, true);
-                if (makePublic) {
-                    const depConfig = readConfig(depInfo.dir);
-                    depConfig.npmVisibility = 'public';
-                    writeConfig(depInfo.dir, depConfig, new Set(['npmVisibility']));
-                    visibilityMap.set(depName, 'public');
-                    console.log(colors.green(`✓ Set ${depName} to public in .globalize.json5`));
+            const deps = { ...pkgInfo.pkg.dependencies, ...pkgInfo.pkg.devDependencies };
+            for (const [depName, depVal] of Object.entries(deps)) {
+                if (typeof depVal !== 'string')
+                    continue;
+                const member = memberByName.get(depName);
+                if (!member)
+                    continue; // External dep, not workspace-internal — out of scope.
+                if (member.pkg.private) {
+                    blockers.push({ pkg: pkgInfo.name, dep: depName, reason: `${depName} has "private": true in package.json (cannot publish)` });
+                    continue;
+                }
+                const depConfig = readConfig(member.dir);
+                if (depConfig.noPublish) {
+                    blockers.push({ pkg: pkgInfo.name, dep: depName, reason: `${depName} has noPublish:true in .globalize.json5` });
+                    continue;
+                }
+                if (visibilityMap.get(depName) !== 'public') {
+                    blockers.push({ pkg: pkgInfo.name, dep: depName, reason: `${depName} is not marked public (set npmVisibility:"public" in its .globalize.json5, or rerun with -public-deps)` });
+                    continue;
                 }
             }
-            else {
-                console.log(colors.dim(`  [dry-run] Would ask to make ${depName} public`));
+        }
+        if (blockers.length > 0) {
+            console.log('');
+            console.log(colors.red('✗ Refusing to publish: public workspace members depend on non-publishable siblings.'));
+            console.log(colors.red('  The published tarball would 404 on a clean install.'));
+            console.log('');
+            for (const b of blockers) {
+                console.log(colors.red(`  ${b.pkg} → ${b.dep}: ${b.reason}`));
             }
+            console.log('');
+            console.log(colors.dim('Fixes:'));
+            console.log(colors.dim('  - Set npmVisibility:"public" in each offending dep\'s .globalize.json5'));
+            console.log(colors.dim('  - Or rerun with -public-deps to auto-promote all transitive workspace deps'));
+            console.log(colors.dim('  - Or remove npmVisibility:"public" from the consumer (keep it bundled under the workspace root)'));
+            return { success: false, packages: [], publishOrder };
         }
     }
     // Sync workspace-root node_modules with member package.json files. Catches

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.169",
+  "version": "1.0.170",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",