@bobfrankston/npmglobalize 1.0.19 → 1.0.21

package/cli.js

@@ -3,6 +3,9 @@
  * npmglobalize CLI - Transform file: dependencies to npm versions for publishing
  */
 import { globalize, readConfig } from './lib.js';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
 function printHelp() {
     console.log(`
 npmglobalize - Transform file: dependencies to npm versions for publishing
@@ -13,9 +16,16 @@ Release Options:
   --patch         Bump patch version (default)
   --minor         Bump minor version
   --major         Bump major version
-  --apply         Just transform, don't publish
+  --nopublish, -np  Just transform, don't publish
   --cleanup       Restore from .dependencies
 
+Dependency Options:
+  --update-deps      Update package.json to latest (minor/patch only, safe)
+  --update-major     Allow major version updates (breaking changes)
+  --no-publish-deps, -npd  Don't auto-publish file: dependencies (use with caution)
+  --force-publish    Republish dependencies even if version exists
+  --fix              Run npm audit fix after transformation
+
 Install Options:
   --install       Global install after publish (Windows)
   --wsl           Also install globally in WSL
@@ -39,20 +49,27 @@ Other Options:
   --conform       Update .gitignore/.npmignore to best practices
   --asis          Skip ignore file checks (or set "asis": true in .globalize.json5)
   --help, -h      Show this help
+  --version, -v   Show version number
 
 Examples:
-  npmglobalize                    Transform + release (patch)
-  npmglobalize --minor            Release with minor version bump
-  npmglobalize --install --wsl    Release + install on Windows and WSL
-  npmglobalize --apply            Just transform, no publish
-  npmglobalize --cleanup          Restore original dependencies
-  npmglobalize --init             Initialize new git repo + release
-  npmglobalize --dry-run          Preview what would happen
+  npmglobalize                       Transform + publish (auto-publishes file: deps)
+  npmglobalize --minor               Release with minor version bump
+  npmglobalize --update-deps         Safe updates (minor/patch only)
+  npmglobalize --update-major        Allow breaking changes (major updates)
+  npmglobalize -npd                  Skip auto-publishing file: deps (use with caution)
+  npmglobalize --force-publish       Force republish all file: dependencies
+  npmglobalize --fix                 Fix security vulnerabilities
+  npmglobalize --install --wsl       Release + install on Windows and WSL
+  npmglobalize -np                   Just transform, no publish
+  npmglobalize --cleanup             Restore original dependencies
+  npmglobalize --init                Initialize new git repo + release
+  npmglobalize --dry-run             Preview what would happen
 `);
 }
 function parseArgs(args) {
     const options = {
         help: false,
+        version: false,
         error: ''
     };
     const unrecognized = [];
@@ -63,6 +80,10 @@ function parseArgs(args) {
             case '-h':
                 options.help = true;
                 break;
+            case '--version':
+            case '-v':
+                options.version = true;
+                break;
             case '--patch':
                 options.bump = 'patch';
                 break;
@@ -72,8 +93,10 @@ function parseArgs(args) {
             case '--major':
                 options.bump = 'major';
                 break;
-            case '--apply':
-                options.applyOnly = true;
+            case '--nopublish':
+            case '-np':
+            case '--apply': // Keep for backward compatibility
+                options.noPublish = true;
                 break;
             case '--cleanup':
                 options.cleanup = true;
@@ -148,6 +171,29 @@ function parseArgs(args) {
             case '--asis':
                 options.asis = true;
                 break;
+            case '--update-deps':
+                options.updateDeps = true;
+                break;
+            case '--update-major':
+                options.updateMajor = true;
+                options.updateDeps = true; // Implies --update-deps
+                break;
+            case '--publish-deps':
+                options.publishDeps = true; // Explicitly enable (though it's default)
+                break;
+            case '--no-publish-deps':
+            case '-npd':
+                options.publishDeps = false; // Disable auto-publishing
+                break;
+            case '--force-publish':
+                options.forcePublish = true;
+                break;
+            case '--fix':
+                options.fix = true;
+                break;
+            case '--no-fix':
+                options.fix = false;
+                break;
             default:
                 if (arg.startsWith('-')) {
                     unrecognized.push(arg);
@@ -167,6 +213,14 @@ export async function main() {
         printHelp();
         process.exit(0);
     }
+    if (cliOptions.version) {
+        const __filename = fileURLToPath(import.meta.url);
+        const __dirname = path.dirname(__filename);
+        const pkgPath = path.join(__dirname, 'package.json');
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        console.log(pkg.version);
+        process.exit(0);
+    }
     if (cliOptions.error) {
         console.error(`Error: ${cliOptions.error}`);
         console.error('Run with --help for usage.');

package/lib.d.ts

@@ -6,7 +6,7 @@ export interface GlobalizeOptions {
     /** Bump type: patch (default), minor, major */
     bump?: 'patch' | 'minor' | 'major';
     /** Just transform, don't publish */
-    applyOnly?: boolean;
+    noPublish?: boolean;
     /** Restore from .dependencies */
     cleanup?: boolean;
     /** Global install after publish */
@@ -35,6 +35,16 @@ export interface GlobalizeOptions {
     conform?: boolean;
     /** Keep ignore files as-is without checking */
     asis?: boolean;
+    /** Check and update existing npm dependencies to latest versions */
+    updateDeps?: boolean;
+    /** Allow major version updates (breaking changes) */
+    updateMajor?: boolean;
+    /** Publish file: dependencies before converting them */
+    publishDeps?: boolean;
+    /** Force republish dependencies even if version exists on npm */
+    forcePublish?: boolean;
+    /** Run npm audit and fix vulnerabilities */
+    fix?: boolean;
 }
 /** Read and parse package.json from a directory */
 export declare function readPackageJson(dir: string): any;
@@ -48,6 +58,20 @@ export declare function writePackageJson(dir: string, pkg: any): void;
 export declare function resolveFilePath(fileRef: string, baseDir: string): string;
 /** Check if a dependency value is a file: reference */
 export declare function isFileRef(value: string): boolean;
+/** Get the latest version of a package from npm */
+export declare function getLatestVersion(packageName: string): string | null;
+/** Check if a specific version of a package exists on npm */
+export declare function checkVersionExists(packageName: string, version: string): boolean;
+/** Update existing npm dependencies to latest versions */
+export declare function updateNpmDeps(pkg: any, verbose?: boolean, allowMajor?: boolean): {
+    updated: boolean;
+    changes: string[];
+    majorAvailable: Array<{
+        name: string;
+        current: string;
+        latest: string;
+    }>;
+};
 /** Get all file: dependencies from package.json */
 export declare function getFileRefs(pkg: any): Map<string, {
     key: string;
@@ -55,7 +79,14 @@ export declare function getFileRefs(pkg: any): Map<string, {
     value: string;
 }>;
 /** Transform file: dependencies to npm versions */
-export declare function transformDeps(pkg: any, baseDir: string, verbose?: boolean): boolean;
+export declare function transformDeps(pkg: any, baseDir: string, verbose?: boolean, forcePublish?: boolean): {
+    transformed: boolean;
+    unpublished: Array<{
+        name: string;
+        version: string;
+        path: string;
+    }>;
+};
 /** Restore file: dependencies from .dependencies */
 export declare function restoreDeps(pkg: any, verbose?: boolean): boolean;
 /** Check if .dependencies exist (already transformed) */
@@ -94,6 +125,12 @@ export declare function confirm(message: string, defaultYes?: boolean): Promise<
 /** Initialize git repository */
 export declare function initGit(cwd: string, visibility: 'private' | 'public', dryRun: boolean): Promise<boolean>;
 /** Main globalize function */
+/** Run npm audit and optionally fix vulnerabilities */
+export declare function runNpmAudit(cwd: string, fix?: boolean, verbose?: boolean): {
+    success: boolean;
+    report: string;
+    hasVulnerabilities: boolean;
+};
 export declare function globalize(cwd: string, options?: GlobalizeOptions): Promise<boolean>;
 declare const _default: {
     globalize: typeof globalize;

package/lib.js

@@ -57,7 +57,7 @@ export function writeConfig(dir, config, explicitKeys) {
     const existing = readConfig(dir);
     // Filter out temporary flags and default values (unless explicitly set)
     const filtered = {};
-    const omitKeys = new Set(['applyOnly', 'cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error']);
+    const omitKeys = new Set(['noPublish', 'cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'forcePublish']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
             continue;
@@ -102,6 +102,8 @@ export function writeConfig(dir, config, explicitKeys) {
                 comment = '  // private or public (default)';
             else if (key === 'bump')
                 comment = '  // patch (default), minor, or major';
+            else if (key === 'fix')
+                comment = '  // Auto-run npm audit fix';
             lines.push(`  "${key}": ${jsonValue}${comma}${comment}`);
         });
         lines.push('');
@@ -117,6 +119,7 @@ export function writeConfig(dir, config, explicitKeys) {
     lines.push('  // "verbose": false             // Show detailed output');
     lines.push('  // "gitVisibility": "private"   // Git repo: private or public');
     lines.push('  // "npmVisibility": "public"    // npm package: private or public');
+    lines.push('  // "fix": false                 // Auto-run npm audit fix');
     lines.push('}');
     fs.writeFileSync(configPath, lines.join('\n') + '\n');
 }
@@ -134,6 +137,119 @@ export function resolveFilePath(fileRef, baseDir) {
 export function isFileRef(value) {
     return typeof value === 'string' && value.startsWith('file:');
 }
+/** Get the latest version of a package from npm */
+export function getLatestVersion(packageName) {
+    try {
+        const result = spawnSync('npm', ['view', packageName, 'version'], {
+            encoding: 'utf-8',
+            stdio: 'pipe',
+            shell: true
+        });
+        if (result.status === 0 && result.stdout) {
+            return result.stdout.trim();
+        }
+        return null;
+    }
+    catch (error) {
+        return null;
+    }
+}
+/** Check if a specific version of a package exists on npm */
+export function checkVersionExists(packageName, version) {
+    try {
+        const result = spawnSync('npm', ['view', `${packageName}@${version}`, 'version'], {
+            encoding: 'utf-8',
+            stdio: 'pipe',
+            shell: true
+        });
+        return result.status === 0 && result.stdout.trim() === version;
+    }
+    catch (error) {
+        return false;
+    }
+}
+/** Parse semver version string to major.minor.patch */
+function parseSemver(version) {
+    const clean = version.replace(/^[^\d]*/, ''); // Remove ^, ~, etc.
+    const match = clean.match(/^(\d+)\.(\d+)\.(\d+)/);
+    if (!match)
+        return null;
+    return {
+        major: parseInt(match[1], 10),
+        minor: parseInt(match[2], 10),
+        patch: parseInt(match[3], 10)
+    };
+}
+/** Check if update is within semver range (^1.0.0 allows minor/patch, not major) */
+function isCompatibleUpdate(currentSpec, latestVersion) {
+    const current = parseSemver(currentSpec);
+    const latest = parseSemver(latestVersion);
+    if (!current || !latest) {
+        return { compatible: true, isMajor: false }; // Can't parse, allow update
+    }
+    const isMajor = latest.major > current.major;
+    const prefix = currentSpec.match(/^[^\d]*/) ? currentSpec.match(/^[^\d]*/)[0] : '^';
+    // ^ allows minor and patch updates within same major version
+    // ~ allows only patch updates
+    if (prefix === '^') {
+        return { compatible: !isMajor, isMajor };
+    }
+    else if (prefix === '~') {
+        return { compatible: latest.major === current.major && latest.minor === current.minor, isMajor };
+    }
+    // For exact versions or other formats, allow all updates
+    return { compatible: true, isMajor };
+}
+/** Update existing npm dependencies to latest versions */
+export function updateNpmDeps(pkg, verbose = false, allowMajor = false) {
+    const changes = [];
+    const majorAvailable = [];
+    let updated = false;
+    for (const key of DEP_KEYS) {
+        if (!pkg[key])
+            continue;
+        for (const [name, value] of Object.entries(pkg[key])) {
+            // Skip file: references - those are handled separately
+            if (isFileRef(value))
+                continue;
+            // Get current and latest versions
+            const currentSpec = value;
+            const latest = getLatestVersion(name);
+            if (latest) {
+                const { compatible, isMajor } = isCompatibleUpdate(currentSpec, latest);
+                const newSpec = '^' + latest;
+                if (currentSpec !== newSpec) {
+                    if (isMajor && !allowMajor) {
+                        // Major update available but not allowed
+                        majorAvailable.push({ name, current: currentSpec, latest: newSpec });
+                        if (verbose) {
+                            console.log(colors.yellow(`  ${name}: ${currentSpec} (major update ${newSpec} available, use --update-major)`));
+                        }
+                    }
+                    else if (compatible || allowMajor) {
+                        // Safe update or major updates allowed
+                        pkg[key][name] = newSpec;
+                        changes.push(`${name}: ${currentSpec} → ${newSpec}`);
+                        if (isMajor) {
+                            console.log(colors.red(`  ${name}: ${currentSpec} → ${newSpec} (MAJOR)`));
+                        }
+                        else {
+                            console.log(colors.yellow(`  ${name}: ${currentSpec} → ${newSpec}`));
+                        }
+                        updated = true;
+                    }
+                }
+                else if (verbose) {
+                    console.log(colors.green(`  ${name}: ${currentSpec} is up to date`));
+                }
+            }
+            else if (verbose) {
+                console.log(colors.italic(`  ${name}: couldn't check npm registry`));
+            }
+        }
+    }
+    return { updated, changes, majorAvailable };
+}
 /** Get all file: dependencies from package.json */
 export function getFileRefs(pkg) {
     const refs = new Map();
@@ -149,8 +265,9 @@ export function getFileRefs(pkg) {
     return refs;
 }
 /** Transform file: dependencies to npm versions */
-export function transformDeps(pkg, baseDir, verbose = false) {
+export function transformDeps(pkg, baseDir, verbose = false, forcePublish = false) {
     let transformed = false;
+    const unpublished = [];
     for (const key of DEP_KEYS) {
         if (!pkg[key])
             continue;
@@ -176,7 +293,22 @@ export function transformDeps(pkg, baseDir, verbose = false) {
                 const targetPath = resolveFilePath(value, baseDir);
                 try {
                     const targetPkg = readPackageJson(targetPath);
-                    const npmVersion = '^' + targetPkg.version;
+                    const targetVersion = targetPkg.version;
+                    const npmVersion = '^' + targetVersion;
+                    // Check if this version exists on npm (or if force publish)
+                    const versionExists = forcePublish ? false : checkVersionExists(name, targetVersion);
+                    if (!versionExists) {
+                        unpublished.push({ name, version: targetVersion, path: targetPath });
+                        if (forcePublish) {
+                            console.log(colors.yellow(`  ⟳ ${name}@${targetVersion} will be republished (--force-publish)`));
+                        }
+                        else {
+                            console.log(colors.red(`  ⚠ ${name}@${targetVersion} not found on npm (local: ${value})`));
+                        }
+                    }
+                    else if (verbose) {
+                        console.log(colors.green(`  ✓ ${name}@${targetVersion} exists on npm`));
+                    }
                     pkg[key][name] = npmVersion;
                     if (verbose) {
                         console.log(`  ${name}: ${value} -> ${npmVersion}`);
@@ -189,7 +321,7 @@ export function transformDeps(pkg, baseDir, verbose = false) {
             }
         }
     }
-    return transformed;
+    return { transformed, unpublished };
 }
 /** Restore file: dependencies from .dependencies */
 export function restoreDeps(pkg, verbose = false) {
@@ -523,6 +655,20 @@ function checkIgnoreFiles(cwd, options) {
 }
 /** Update ignore files to conform to best practices */
 function conformIgnoreFiles(cwd) {
+    // Update .gitattributes for LF line endings
+    const gitattributesPath = path.join(cwd, '.gitattributes');
+    const gitattributesContent = '* text=auto eol=lf\n';
+    if (!fs.existsSync(gitattributesPath)) {
+        fs.writeFileSync(gitattributesPath, gitattributesContent);
+        console.log(colors.green('  ✓ Created .gitattributes (LF line endings)'));
+    }
+    else {
+        const content = fs.readFileSync(gitattributesPath, 'utf-8');
+        if (!content.includes('eol=lf')) {
+            fs.writeFileSync(gitattributesPath, gitattributesContent);
+            console.log(colors.green('  ✓ Updated .gitattributes (LF line endings)'));
+        }
+    }
     // Update .gitignore
     const gitignorePath = path.join(cwd, '.gitignore');
     if (fs.existsSync(gitignorePath)) {
@@ -680,8 +826,100 @@ export async function initGit(cwd, visibility, dryRun) {
     return true;
 }
 /** Main globalize function */
+/** Run npm audit and optionally fix vulnerabilities */
+export function runNpmAudit(cwd, fix = false, verbose = false) {
+    console.log('');
+    console.log(colors.yellow('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+    console.log(colors.yellow('🔒 npm audit'));
+    console.log(colors.yellow('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+    if (fix) {
+        console.log('Running npm audit fix...');
+        const fixResult = runCommand('npm', ['audit', 'fix'], { cwd, silent: false, shell: true });
+        if (!fixResult.success) {
+            console.log(colors.yellow('⚠ Some vulnerabilities could not be automatically fixed'));
+        }
+        else {
+            console.log(colors.green('✓ Audit fixes applied'));
+        }
+    }
+    // Always run audit to report status
+    const auditResult = spawnSync('npm', ['audit', '--json'], {
+        cwd,
+        encoding: 'utf-8',
+        stdio: 'pipe',
+        shell: true
+    });
+    let hasVulnerabilities = false;
+    let report = '';
+    if (auditResult.status !== 0 || auditResult.stdout) {
+        try {
+            const auditData = JSON.parse(auditResult.stdout || '{}');
+            const { vulnerabilities = {} } = auditData;
+            const critical = auditData.metadata?.vulnerabilities?.critical || 0;
+            const high = auditData.metadata?.vulnerabilities?.high || 0;
+            const moderate = auditData.metadata?.vulnerabilities?.moderate || 0;
+            const low = auditData.metadata?.vulnerabilities?.low || 0;
+            const info = auditData.metadata?.vulnerabilities?.info || 0;
+            const total = critical + high + moderate + low + info;
+            if (total > 0) {
+                hasVulnerabilities = true;
+                report = `Found ${total} vulnerabilities`;
+                const parts = [];
+                if (critical > 0)
+                    parts.push(colors.red(`${critical} critical`));
+                if (high > 0)
+                    parts.push(colors.red(`${high} high`));
+                if (moderate > 0)
+                    parts.push(colors.yellow(`${moderate} moderate`));
+                if (low > 0)
+                    parts.push(`${low} low`);
+                if (info > 0)
+                    parts.push(`${info} info`);
+                console.log('');
+                console.log(colors.yellow(`Vulnerabilities: ${parts.join(', ')}`));
+                if (verbose && Object.keys(vulnerabilities).length > 0) {
+                    console.log('');
+                    console.log('Details:');
+                    for (const [pkg, data] of Object.entries(vulnerabilities)) {
+                        const vulnData = data;
+                        const severity = vulnData.severity || 'unknown';
+                        const severityColor = severity === 'critical' || severity === 'high' ? colors.red :
+                            severity === 'moderate' ? colors.yellow : (s) => s;
+                        console.log(`  ${severityColor(severity)}: ${pkg}`);
+                    }
+                }
+                if (!fix) {
+                    console.log('');
+                    console.log(colors.yellow('Run with --fix to automatically fix vulnerabilities'));
+                }
+            }
+            else {
+                console.log(colors.green('✓ No vulnerabilities found'));
+                report = 'No vulnerabilities';
+            }
+        }
+        catch (e) {
+            // Fallback to text output if JSON parsing fails
+            console.log('Running text audit...');
+            const textResult = runCommand('npm', ['audit'], { cwd, silent: false, shell: true });
+            report = 'Audit completed (see output above)';
+        }
+    }
+    else {
+        console.log(colors.green('✓ No vulnerabilities found'));
+        report = 'No vulnerabilities';
+    }
+    console.log(colors.yellow('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+    console.log('');
+    return {
+        success: true,
+        report,
+        hasVulnerabilities
+    };
+}
 export async function globalize(cwd, options = {}) {
-    const { bump = 'patch', applyOnly = false, cleanup = false, install = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'public', message, conform = false, asis = false } = options;
+    const { bump = 'patch', noPublish = false, cleanup = false, install = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'public', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
+    forcePublish = false, fix = false } = options;
     // Check ignore files first (unless cleanup mode)
     if (!cleanup && !asis) {
         const checkResult = checkIgnoreFiles(cwd, { conform, asis, verbose });
@@ -727,8 +965,8 @@ export async function globalize(cwd, options = {}) {
         }
         return true;
     }
-    // Check npm authentication early (unless dry-run or apply-only)
-    if (!dryRun && !applyOnly) {
+    // Check npm authentication early (unless dry-run or no-publish)
+    if (!dryRun && !noPublish) {
         const authStatus = checkNpmAuth();
         if (!authStatus.authenticated) {
             console.error(colors.red('\n✗ npm authentication required'));
@@ -854,15 +1092,90 @@ export async function globalize(cwd, options = {}) {
         // Default is public - just inform
         console.log(`Will publish '${pkg.name}' to PUBLIC npm registry (default).`);
     }
+    // Update existing npm dependencies if requested
+    if (updateDeps) {
+        console.log('Checking for dependency updates...');
+        const updateResult = updateNpmDeps(pkg, verbose, updateMajor);
+        if (updateResult.updated) {
+            console.log(colors.green(`Updated ${updateResult.changes.length} dependencies`));
+            if (!dryRun) {
+                writePackageJson(cwd, pkg);
+            }
+        }
+        else {
+            console.log('All npm dependencies are up to date.');
+        }
+        // Show summary of available major updates
+        if (updateResult.majorAvailable.length > 0 && !updateMajor) {
+            console.log('');
+            console.log(colors.yellow(`${updateResult.majorAvailable.length} major update(s) available (use --update-major):`));
+            for (const { name, current, latest } of updateResult.majorAvailable) {
+                console.log(colors.yellow(`  ${name}: ${current} → ${latest}`));
+            }
+        }
+    }
     // Transform dependencies
     console.log('Transforming file: dependencies...');
     const alreadyTransformed = hasBackup(pkg);
     if (alreadyTransformed) {
         console.log('  Already transformed (found .dependencies)');
     }
-    const transformed = transformDeps(pkg, cwd, verbose);
-    if (transformed) {
+    const transformResult = transformDeps(pkg, cwd, verbose, forcePublish);
+    if (transformResult.transformed) {
         console.log('  Dependencies transformed.');
+        // Check if target packages need to be published
+        if (transformResult.unpublished.length > 0) {
+            console.log('');
+            console.log(colors.red('⚠ WARNING: Some file: dependencies are not published on npm:'));
+            for (const { name, version, path } of transformResult.unpublished) {
+                console.log(colors.yellow(`  ${name}@${version} (${path})`));
+            }
+            console.log('');
+            if (publishDeps) {
+                const action = forcePublish ? 'Publishing/updating' : 'Publishing';
+                console.log(`${action} file: dependencies first (--publish-deps)...`);
+                for (const { name, version, path } of transformResult.unpublished) {
+                    console.log('');
+                    console.log(colors.yellow(`━━━ Publishing ${name}@${version} ━━━`));
+                    if (!dryRun) {
+                        // Recursively call globalize on the dependency
+                        const depSuccess = await globalize(path, {
+                            bump: 'patch', // Use existing version, don't bump
+                            verbose,
+                            quiet,
+                            force,
+                            files,
+                            gitVisibility,
+                            npmVisibility
+                        });
+                        if (!depSuccess) {
+                            console.error(colors.red(`Failed to publish ${name}`));
+                            if (!force) {
+                                return false;
+                            }
+                        }
+                    }
+                    else {
+                        console.log(`  [dry-run] Would publish ${name}`);
+                    }
+                }
+                console.log('');
+                console.log(colors.green('✓ All dependencies published'));
+            }
+            else {
+                console.log(colors.yellow('Options:'));
+                console.log(colors.yellow('  1. Publish them manually first'));
+                console.log(colors.yellow('  2. Use --publish-deps to publish them automatically'));
+                console.log(colors.yellow('  3. Use --force to continue anyway (NOT RECOMMENDED)'));
+                console.log('');
+                if (!force) {
+                    const shouldContinue = await confirm('Continue with unpublished dependencies?', false);
+                    if (!shouldContinue) {
+                        return false;
+                    }
+                }
+            }
+        }
         if (!dryRun) {
             writePackageJson(cwd, pkg);
         }
@@ -870,8 +1183,21 @@ export async function globalize(cwd, options = {}) {
     else if (!alreadyTransformed) {
         console.log('  No file: dependencies found.');
     }
-    if (applyOnly) {
-        console.log('Transform complete (--apply mode).');
+    // Run npm audit if requested or if dependencies were transformed
+    if ((fix || updateDeps) && (transformResult.transformed || alreadyTransformed || updateDeps)) {
+        if (!dryRun) {
+            runNpmAudit(cwd, fix, verbose);
+        }
+        else {
+            console.log('  [dry-run] Would run npm audit');
+        }
+    }
+    else if (fix && !dryRun) {
+        // Run fix even if no deps changed
+        runNpmAudit(cwd, fix, verbose);
+    }
+    if (noPublish) {
+        console.log('Transform complete (--nopublish mode).');
         return true;
     }
     // Skip if private
@@ -1073,7 +1399,7 @@ export async function globalize(cwd, options = {}) {
                 console.error(colors.yellow('  3. Authentication token expired'));
                 console.error('');
             }
-            if (transformed) {
+            if (transformResult.transformed) {
                 console.log('Run --cleanup to restore file: dependencies');
             }
             return false;
@@ -1095,8 +1421,9 @@ export async function globalize(cwd, options = {}) {
         }
     }
     // Global install
-    const pkgName = pkg.name;
-    const pkgVersion = pkg.version;
+    const updatedPkg = readPackageJson(cwd); // Re-read to get updated version
+    const pkgName = updatedPkg.name;
+    const pkgVersion = updatedPkg.version;
     if (install) {
         console.log(`Installing globally: ${pkgName}@${pkgVersion}...`);
         if (!dryRun) {
@@ -1145,7 +1472,7 @@ export async function globalize(cwd, options = {}) {
         }
     }
     // Finalize - restore file: paths if --files mode (default)
-    if (files && transformed) {
+    if (files && transformResult.transformed) {
         console.log('Restoring file: dependencies (--files mode)...');
         const finalPkg = readPackageJson(cwd);
         restoreDeps(finalPkg, verbose);
@@ -1163,6 +1490,11 @@ export async function globalize(cwd, options = {}) {
         console.log('Keeping npm versions (--nofiles mode).');
     }
     console.log('Done!');
+    // Run final audit report if not already run
+    const auditAlreadyRun = (fix || updateDeps) && (transformResult.transformed || alreadyTransformed || updateDeps);
+    if (!auditAlreadyRun && (fix || updateDeps || transformResult.transformed) && !dryRun) {
+        runNpmAudit(cwd, false, verbose); // Just report, don't fix again
+    }
     // Print summary
     console.log('');
     console.log(colors.green('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
@@ -1179,7 +1511,7 @@ export async function globalize(cwd, options = {}) {
     if (wsl) {
         console.log(`  Installed in WSL: ${colors.green('✓')}`);
     }
-    if (files && transformed) {
+    if (files && transformResult.transformed) {
         console.log(`  Restored file: deps: ${colors.green('✓')}`);
     }
     console.log(colors.green('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",