@bobfrankston/npmglobalize 1.0.170 → 1.0.172

package/lib.d.ts

@@ -171,6 +171,24 @@ export declare function checkVersionExists(packageName: string, version: string)
 export declare function checkPackageExists(packageName: string): boolean;
 /** Check npm package access level (public/restricted/null if not published) */
 export declare function checkNpmAccess(packageName: string): 'public' | 'restricted' | null;
+/** Walk `file:` deps transitively from a starting directory and ensure each is set
+ *  up to be installable from a public consumer: persists `npmVisibility:"public"` in
+ *  each dep's `.globalize.json5`, and flips npm access from `restricted` to `public`
+ *  for any dep that's already on npm. Returns blockers for deps that can't be made
+ *  public (private:true or noPublish:true). Used by single-package `-public-deps`
+ *  to handle deps that are unchanged locally — those would otherwise be skipped by
+ *  the cascade and stay private on npm. */
+export declare function cascadePublicVisibility(cwd: string, opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<{
+    promoted: string[];
+    configWritten: string[];
+    blockers: Array<{
+        name: string;
+        reason: string;
+    }>;
+}>;
 /** Check if public package has private/inaccessible dependencies */
 export declare function checkPrivateDependencies(pkg: any, verbose?: boolean): {
     name: string;

package/lib.js

@@ -565,6 +565,113 @@ export function checkNpmAccess(packageName) {
         return null;
     }
 }
+/** Walk `file:` deps transitively from a starting directory and ensure each is set
+ *  up to be installable from a public consumer: persists `npmVisibility:"public"` in
+ *  each dep's `.globalize.json5`, and flips npm access from `restricted` to `public`
+ *  for any dep that's already on npm. Returns blockers for deps that can't be made
+ *  public (private:true or noPublish:true). Used by single-package `-public-deps`
+ *  to handle deps that are unchanged locally — those would otherwise be skipped by
+ *  the cascade and stay private on npm. */
+export async function cascadePublicVisibility(cwd, opts = {}) {
+    const { dryRun = false, verbose = false } = opts;
+    const promoted = [];
+    const configWritten = [];
+    const blockers = [];
+    const visited = new Set();
+    const processed = new Set(); // dedupe by package name across diamond deps
+    async function walk(dir) {
+        let real;
+        try {
+            real = fs.realpathSync(dir);
+        }
+        catch {
+            return;
+        }
+        if (visited.has(real))
+            return;
+        visited.add(real);
+        let pkg;
+        try {
+            pkg = readPackageJson(dir);
+        }
+        catch {
+            return;
+        }
+        for (const key of DEP_KEYS) {
+            // Use the .dependencies backup if present (has original file: refs).
+            const deps = pkg['.' + key] || pkg[key];
+            if (!deps)
+                continue;
+            for (const [name, value] of Object.entries(deps)) {
+                if (typeof value !== 'string' || !isFileRef(value))
+                    continue;
+                let targetPath;
+                try {
+                    targetPath = resolveFilePath(value, dir);
+                }
+                catch {
+                    continue;
+                }
+                if (!fs.existsSync(path.join(targetPath, 'package.json')))
+                    continue;
+                let targetPkg;
+                try {
+                    targetPkg = readPackageJson(targetPath);
+                }
+                catch {
+                    continue;
+                }
+                const targetName = targetPkg.name || name;
+                if (!processed.has(targetName)) {
+                    processed.add(targetName);
+                    if (targetPkg.private) {
+                        blockers.push({ name: targetName, reason: '"private": true in package.json (cannot publish to npm)' });
+                    }
+                    else {
+                        const targetConfig = readConfig(targetPath);
+                        if (targetConfig.noPublish) {
+                            blockers.push({ name: targetName, reason: 'noPublish:true in .globalize.json5' });
+                        }
+                        else {
+                            if (targetConfig.npmVisibility !== 'public') {
+                                if (!dryRun) {
+                                    targetConfig.npmVisibility = 'public';
+                                    writeConfig(targetPath, targetConfig, new Set(['npmVisibility']));
+                                }
+                                configWritten.push(targetName);
+                                if (verbose)
+                                    console.log(colors.dim(`  ${targetName}: npmVisibility:"public" written to .globalize.json5`));
+                            }
+                            const access = checkNpmAccess(targetName);
+                            if (access === 'restricted') {
+                                if (!dryRun) {
+                                    const r = runCommand('npm', ['access', 'set', 'status=public', targetName], { cwd: targetPath, silent: true });
+                                    if (r.success) {
+                                        promoted.push(targetName);
+                                        console.log(colors.green(`  ✓ Flipped ${targetName} to PUBLIC on npm`));
+                                    }
+                                    else {
+                                        blockers.push({ name: targetName, reason: `npm access set failed: ${r.stderr || r.output || 'unknown'}` });
+                                    }
+                                }
+                                else {
+                                    console.log(colors.dim(`  [dry-run] Would flip ${targetName} to PUBLIC on npm`));
+                                }
+                            }
+                            else if (access === 'public' && verbose) {
+                                console.log(colors.dim(`  ${targetName}: already PUBLIC on npm`));
+                            }
+                            // access === null: not on npm yet — the cascade publish step handles that.
+                        }
+                    }
+                }
+                await walk(targetPath);
+            }
+        }
+    }
+    await walk(cwd);
+    return { promoted, configWritten, blockers };
+}
 /** Check if public package has private/inaccessible dependencies */
 export function checkPrivateDependencies(pkg, verbose = false) {
     const privateDeps = [];
@@ -3844,6 +3951,32 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             console.log(colors.dim(`Would add publishConfig.access: "public" to package.json`));
         }
     }
+    // -public-deps pre-pass: at the top of the user-invoked call, walk file: deps
+    // transitively and flip any that are already on npm but currently `restricted`
+    // to `public`, persisting `npmVisibility:"public"` in each dep's .globalize.json5.
+    // This handles the case where a public consumer's deps are unchanged locally
+    // (so the cascade publish step would skip them) but published as private —
+    // public installers would 404. Only runs once at the top level (suppressed in
+    // recursive cascade and workspace-orchestrated calls, which already handle this).
+    if (publicDeps && !options._fromDep && !options._fromWorkspace) {
+        console.log(colors.italic('-public-deps: walking file: deps to ensure all are PUBLIC on npm...'));
+        const result = await cascadePublicVisibility(cwd, { dryRun, verbose });
+        if (result.promoted.length === 0 && result.configWritten.length === 0 && verbose) {
+            console.log(colors.dim('  (no changes needed)'));
+        }
+        if (result.blockers.length > 0) {
+            console.log('');
+            console.log(colors.red('✗ -public-deps: cannot make every transitive dep public:'));
+            for (const b of result.blockers) {
+                console.log(colors.red(`  ${b.name}: ${b.reason}`));
+            }
+            if (!force) {
+                return false;
+            }
+            console.log(colors.yellow('Continuing with --force despite blockers...'));
+        }
+        console.log('');
+    }
     // Check for private dependencies in public packages
     const willBePublic = effectiveNpmVisibility === 'public' ||
         currentAccess === 'public' ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.170",
+  "version": "1.0.172",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",