@bobfrankston/npmglobalize 1.0.191 → 1.0.193

package/_synctoken.cjs

@@ -0,0 +1,28 @@
+// One-shot: copy the current Windows npm authToken into WSL's ~/.npmrc.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const winNpmrc = path.join(os.homedir(), '.npmrc');
+const wslNpmrc = '\\\\wsl.localhost\\Ubuntu\\home\\bob\\.npmrc';
+const KEY = '//registry.npmjs.org/:_authToken=';
+
+const winText = fs.readFileSync(winNpmrc, 'utf8');
+const m = winText.match(/\/\/registry\.npmjs\.org\/:_authToken=(\S+)/);
+if (!m) { console.error('No Windows token found in', winNpmrc); process.exit(1); }
+const token = m[1];
+
+let wslText = '';
+try { wslText = fs.readFileSync(wslNpmrc, 'utf8'); }
+catch (e) { console.error('Cannot read WSL .npmrc:', e.message); process.exit(1); }
+
+const line = KEY + token;
+const lines = wslText.split(/\r?\n/);
+let replaced = false;
+for (let i = 0; i < lines.length; i++) {
+    if (lines[i].startsWith(KEY)) { lines[i] = line; replaced = true; }
+}
+if (!replaced) lines.push(line);
+const out = lines.filter((l, i) => !(l === '' && i === lines.length - 1)).join('\n') + '\n';
+fs.writeFileSync(wslNpmrc, out);
+console.log(replaced ? 'Replaced stale WSL token' : 'Added token to WSL .npmrc', '(tail ...' + token.slice(-6) + ')');

package/_synctoken.d.cts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=_synctoken.d.cts.map

package/cli.js

@@ -2,10 +2,10 @@
 /**
  * npmglobalize CLI - Transform file: dependencies to npm versions for publishing
  */
-import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, getBuildIssues, clearBuildIssues, ensureFileDepModules, buildProject, buildFileDepsTopologically } from './lib.js';
+import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, getBuildIssues, clearBuildIssues, ensureFileDepModules, buildProject, buildFileDepsTopologically, reportTs7Deprecations } from './lib.js';
 import fs from 'fs';
 import path from 'path';
-import { styleText } from 'util';
+import { colors } from './colors.js';
 // npmglobalize install directory (for --version)
 const __dirname = import.meta.dirname;
 /** Own version, read once. Stamped into the startup banner AND the Issues Summary
@@ -116,6 +116,11 @@ Other Options:
                   Before npm pack, wipe node_modules/ in each file: dep target.
                   Fixes arborist "Cannot read properties of null" crashes when
                   sibling file: deps have their own nested node_modules.
+  -ts7-report, -deprecation-report
+                  Report-only: scan this package and its file: deps for
+                  compilerOptions removed in TypeScript 7 (deprecated
+                  moduleResolution, target es3, deprecated flags). Lists a
+                  migration to-do list and exits. Writes nothing.
   -show           Show package.json dependency changes
   -package, -pkg  Update package.json scripts to use npmglobalize
   -h, -help       Show this help
@@ -155,6 +160,7 @@ function parseArgs(args) {
         help: false,
         version: false,
         error: '',
+        ts7Report: false,
         explicitKeys: new Set()
     };
     const unrecognized = [];
@@ -172,6 +178,10 @@ function parseArgs(args) {
             case '-v':
                 options.version = true;
                 break;
+            case '-ts7-report':
+            case '-deprecation-report':
+                options.ts7Report = true;
+                break;
             case '-patch':
                 options.bump = 'patch';
                 break;
@@ -423,24 +433,55 @@ function parseArgs(args) {
     }
     return options;
 }
-/** Print accumulated build issues in warning color */
+/** Print accumulated build issues, colored per severity via the theme module. */
 function printBuildSummary() {
     const issues = getBuildIssues();
     if (issues.length === 0)
         return;
     console.log('');
-    console.log(styleText('yellow', `━━━ Issues Summary (npmglobalize v${NPMGLOBALIZE_VERSION}) ━━━`));
+    console.log(colors.warn(`━━━ Issues Summary (npmglobalize v${NPMGLOBALIZE_VERSION}) ━━━`));
     for (const issue of issues) {
+        // Errors in red (readable on any background); warnings in the theme warn color.
+        const paint = issue.severity === 'error' ? colors.error : colors.warn;
         const icon = issue.severity === 'error' ? '✗' : '⚠';
-        console.log(styleText('yellow', `  ${icon} ${issue.module}: ${issue.message}`));
+        console.log(paint(`  ${icon} ${issue.module}: ${issue.message}`));
     }
-    console.log(styleText('yellow', '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+    console.log(colors.warn('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+    console.log('');
+}
+/** Print the report-only TS7-readiness scan over cwd + its file: dep graph. */
+function printTs7Report(cwd) {
+    const findings = reportTs7Deprecations(cwd);
+    console.log('');
+    console.log(colors.accent('━━━ TypeScript 7 readiness ━━━'));
+    if (findings.length === 0) {
+        console.log(colors.success('  ✓ No removed-in-TS7 compilerOptions found in this package or its file: deps.'));
+        console.log('');
+        return;
+    }
+    // Group by package for a readable migration to-do list.
+    const byPkg = new Map();
+    for (const f of findings) {
+        if (!byPkg.has(f.name))
+            byPkg.set(f.name, []);
+        byPkg.get(f.name).push(f);
+    }
+    console.log(colors.warn(`  ${findings.length} item(s) across ${byPkg.size} package(s) need migration before TypeScript 7:`));
+    for (const [name, items] of byPkg) {
+        console.log(colors.accent(`\n  ${name}`));
+        for (const f of items) {
+            console.log(colors.warn(`    • ${f.option}: ${JSON.stringify(f.value)}  (in ${f.definedIn})`));
+            console.log(colors.muted(`        → ${f.action}`));
+        }
+    }
+    console.log(colors.muted('\n  Note: npmglobalize auto-applies these migrations at build time when a deprecation error fires —'));
+    console.log(colors.muted('  it does NOT silence them with "ignoreDeprecations". Any ignoreDeprecations above is itself a flagged bug.'));
     console.log('');
 }
 export async function main() {
     installCleanupHandlers();
     // Show version at the very start
-    console.log(styleText('cyan', `npmglobalize v${NPMGLOBALIZE_VERSION}`));
+    console.log(colors.accent(`npmglobalize v${NPMGLOBALIZE_VERSION}`));
     const args = process.argv.slice(2);
     const cliOptions = parseArgs(args);
     if (cliOptions.help) {
@@ -469,6 +510,11 @@ export async function main() {
             process.exit(1);
         }
     }
+    // Report-only TS7-readiness scan (no transform / build / publish).
+    if (cliOptions.ts7Report) {
+        printTs7Report(cwd);
+        process.exit(0);
+    }
     // Build file: deps topologically, then the target itself.
     // Ensures consumers' tsc sees up-to-date `.d.ts` from sibling checkouts
     // whose source has changed since their last build.
@@ -480,14 +526,14 @@ export async function main() {
             process.exit(1);
         }
         if (!depsOk)
-            console.log(styleText('yellow', 'Continuing with --force despite dep build failure...'));
+            console.log(colors.warn('Continuing with --force despite dep build failure...'));
         const targetOk = await buildProject(cwd, { verbose: !!cliOptions.verbose, force: !!cliOptions.force });
         if (!targetOk) {
             if (!cliOptions.force) {
                 printBuildSummary();
                 process.exit(1);
             }
-            console.log(styleText('yellow', 'Continuing with --force...'));
+            console.log(colors.warn('Continuing with --force...'));
         }
     }
     // Handle --package: update scripts in target package.json

package/colors.js

@@ -18,7 +18,11 @@ function detectTheme() {
         return 'light';
     if (process.env.NPMG_THEME === 'dark')
         return 'dark';
-    return 'dark';
+    // Unknown background: default to the 'light' palette. Its colors (magenta warn,
+    // red, green, blue, cyan) are all readable on BOTH light and dark terminals,
+    // whereas the 'dark' palette's yellow warn is invisible on a light background.
+    // Per global pref: never default to yellow on an unknown background.
+    return 'light';
 }
 const theme = detectTheme();
 // Raw ANSI colors per theme — semantic → [dark, light]

package/lib.d.ts

@@ -328,6 +328,25 @@ export declare function buildFileDepsTopologically(cwd: string, opts?: {
     verbose?: boolean;
     force?: boolean;
 }, visited?: Set<string>): Promise<boolean>;
+/** A single TS7-readiness problem found in a package's effective tsconfig. */
+export interface Ts7Finding {
+    name: string;
+    dir: string;
+    option: string;
+    value: string;
+    /** tsconfig (relative to the package dir) where the value is actually set —
+     *  may be the package's own file or a base it extends. */
+    definedIn: string;
+    action: string;
+}
+/** Report-only TS7-readiness scan over `cwd` and its `file:` dep graph. For each
+ *  package with a tsconfig it resolves the *effective* compilerOptions through the
+ *  `extends` chain and flags removed-in-TS7 settings (deprecated `moduleResolution`,
+ *  `target: es3`, and the deprecated boolean flags) plus any `ignoreDeprecations`
+ *  (itself a flagged bug — it silences a real TS7 error). Reads only — never writes.
+ *  The same migration `migrateTsconfigDeprecations` applies automatically on a build
+ *  failure; this report is the read-only, whole-graph inventory. */
+export declare function reportTs7Deprecations(cwd: string): Ts7Finding[];
 /** Ensure the workspace-root `node_modules/` is in sync with every member's
  *  declared deps. Workspaces hoist deps to the root, so a dep added to any
  *  member `package.json` without a follow-up `npm install` at the root leaves
@@ -337,6 +356,38 @@ export declare function ensureWorkspaceDepModules(rootDir: string, members: Arra
     dir: string;
     pkg: any;
 }>, verbose?: boolean): Promise<void>;
+/** Extract the lines a human needs from a failed npm command's output: the
+ *  `npm error` lines minus stack frames and brace-only object-dump fragments,
+ *  deduped. The full output belongs in a log file (saveNpmLog), not the terminal. */
+export declare function distillNpmErrors(combined: string): string[];
+/** Scan a puppeteer browser cache (layout <root>/<browser>/<platform-version>)
+ *  and repair every version folder that has no browser executable in it — the
+ *  residue of a truncated extraction (see extractBrowserArchive for the Node
+ *  26 extract-zip bug that produces these). Per corrupt folder:
+ *  1. If the downloaded archive still sits next to it (the usual case right
+ *     after a truncating run — the hung extraction means puppeteer's cleanup
+ *     never deleted it), finish the extraction with the system unzipper. This
+ *     is the only path that converges on Node 26, where re-extraction by
+ *     puppeteer truncates again every time.
+ *  2. Otherwise delete the folder so the next attempt re-downloads.
+ *
+ *  Timing matters: a truncating install EXITS 0, so the poisoned cache hides
+ *  behind a successful install — and the NEXT install deletes the leftover
+ *  archive before erroring. So this must run right after a SUCCESSFUL install
+ *  (while the archive is still there), not only on failure. */
+export declare function verifyPuppeteerCache(cacheRoot?: string): {
+    repaired: string[];
+    removed: string[];
+};
+/** Detect puppeteer's corrupted-browser-cache failure ("browser folder exists
+ *  but the executable is missing") in failed install output and repair the
+ *  whole cache it points into (verifyPuppeteerCache — the installer checks
+ *  browsers in parallel and only reports the first corrupt one, so siblings
+ *  are usually poisoned too). Returns the folders repaired or removed. */
+export declare function fixPuppeteerCorruptedCache(combined: string): {
+    repaired: string[];
+    removed: string[];
+};
 /** Run a command and return success status */
 export declare function runCommand(cmd: string, args: string[], options?: {
     silent?: boolean;
@@ -364,9 +415,6 @@ export declare function runCommandAsync(cmd: string, args: string[], options?: {
     stderr: string;
     signal: NodeJS.Signals | null;
 }>;
-/** Install a package globally in WSL, auto-fixing the root-owned /usr/local/lib/node_modules
- *  EACCES case by switching npm to a user prefix (~/.npm-global) and retrying once.
- *  Output is captured (so we can scan for the error) and then mirrored to the terminal. */
 export declare function installInWsl(wslArgs: string[], opts?: {
     cwd?: string;
 }): Promise<{

package/lib.js

@@ -1975,6 +1975,39 @@ function insertCompilerOption(text, key, valueLiteral) {
     // Inline single-line object: `{ "target": ... }`
     return text.slice(0, braceEnd) + ` ${prop},` + text.slice(braceEnd);
 }
+/** Replace the value of an existing top-level `compilerOptions.<key>` in `text`,
+ *  preserving the file's formatting. The key's value may be a quoted string, a
+ *  boolean/number, or any run up to the next comma/brace/newline. Returns the
+ *  patched text, or null if the key isn't present as a simple property. */
+function replaceCompilerOptionValue(text, key, newValueLiteral) {
+    const re = new RegExp(`("${key}"\\s*:\\s*)("(?:[^"\\\\]|\\\\.)*"|[^,}\\n]+)`);
+    const m = text.match(re);
+    if (!m)
+        return null;
+    return text.slice(0, m.index) + m[1] + newValueLiteral + text.slice(m.index + m[0].length);
+}
+/** Set `compilerOptions.<key>` to `valueLiteral`: replace it in place if already
+ *  present, otherwise insert it. Returns patched text, or null if neither could be
+ *  done safely (no locatable `compilerOptions` object). */
+function upsertCompilerOption(text, key, valueLiteral) {
+    const replaced = replaceCompilerOptionValue(text, key, valueLiteral);
+    if (replaced !== null)
+        return replaced;
+    return insertCompilerOption(text, key, valueLiteral);
+}
+/** Remove the whole `compilerOptions.<key>` property line. Works for the usual
+ *  one-option-per-line tsconfig formatting; returns null if `<key>` isn't on its
+ *  own line (caller then reports it as a manual fix). A trailing comma left on the
+ *  preceding line is fine — tsconfig is parsed as JSONC (trailing commas allowed). */
+function removeCompilerOptionLine(text, key) {
+    const lines = text.split('\n');
+    const re = new RegExp(`^\\s*"${key}"\\s*:`);
+    const idx = lines.findIndex(l => re.test(l));
+    if (idx === -1)
+        return null;
+    lines.splice(idx, 1);
+    return lines.join('\n');
+}
 /** Insert a `"types": [...]` line as the first property of `compilerOptions`.
  *  Only ever called when `compilerOptions.types` is absent. */
 function insertTypesIntoTsconfig(text, typesArr) {
@@ -2107,54 +2140,109 @@ function ensureTsconfigNodeTypes(cwd) {
     }
     recordBuildIssue(chain[0].parsed?.name || path.basename(cwd), 'warning', `TS6+ build may fail: no writable compilerOptions block in the tsconfig chain of ${cwd} to add "types"`);
 }
-/** TS6 turned several long-deprecated compiler options (e.g.
- *  `moduleResolution: "node10"`/`"node"`/`"classic"`, old `target`s) into hard
- *  errors (`TS5107`/`TS5101`) that will be *removed* in TS7. TypeScript's own
- *  sanctioned bridge for the 6→7 window is `"ignoreDeprecations": "<version>"`
- *  (the error text names the version, e.g. `"6.0"`). We apply exactly that so the
- *  build proceeds, and record a warning so the real migration (to `node16` /
- *  `nodenext` / `bundler`) still happens before TS7. We do NOT auto-rewrite
- *  `moduleResolution` itself — that changes resolution semantics and must be a
- *  human, per-package decision. Returns true if it patched a file. Mirrors
- *  `ensureTsconfigNodeTypes`: resolves the `extends` chain, respects an existing
- *  `ignoreDeprecations`, and patches the base-most writable config. */
-function ensureTsconfigIgnoreDeprecations(cwd, version) {
+/** TS6 turned several long-deprecated compiler options (`moduleResolution:
+ *  "node10"`/`"node"`/`"classic"`, `target: "es3"`, the dead boolean flags) into
+ *  hard errors (`TS5107`/`TS5101`) that TS7 *removes*. We deliberately do NOT
+ *  silence them with `"ignoreDeprecations"` — that just defers a real error to the
+ *  day TS7 lands. Instead we perform the actual migration in place:
+ *    • `moduleResolution` → `"nodenext"` (and align `module` to `"nodenext"`, since
+ *      `nodenext` resolution requires a `nodenext`/`node16`/`preserve` module),
+ *    • `target: "es3"` → `"es2022"`,
+ *    • delete each dead flag (`importsNotUsedAsValues`, `out`, …).
+ *  Each option is edited in the writable file where it's defined; when it's
+ *  inherited from a `node_modules` base we instead write an override into the
+ *  most-leaf writable config so it wins. This is a *semantic* change: the rebuild
+ *  may now surface genuine resolution errors — that is the point. Those are real
+ *  bugs the `node10` resolver was hiding, not deprecations. Returns true if it
+ *  changed any file. */
+function migrateTsconfigDeprecations(cwd) {
     const tsconfigPath = path.join(cwd, 'tsconfig.json');
     if (!fs.existsSync(tsconfigPath))
         return false;
-    const { chain, truncated } = resolveTsconfigChain(tsconfigPath);
+    const { chain } = resolveTsconfigChain(tsconfigPath);
     if (!chain.length)
         return false;
-    // Already set somewhere in the chain (possibly with a different version) — leave it.
-    if (chain.some(c => c.parsed?.compilerOptions?.ignoreDeprecations !== undefined))
-        return false;
-    if (truncated)
-        return false;
-    const valueLiteral = JSON.stringify(version);
-    const candidates = chain.filter(c => c.writable).reverse();
-    for (const cand of candidates) {
+    const name = (() => { try {
+        return readPackageJson(cwd).name;
+    }
+    catch {
+        return null;
+    } })()
+        || chain[0].parsed?.name || path.basename(cwd);
+    const mostLeafWritable = chain.find(c => c.writable); // chain is leaf-first
+    /** File to edit for an option defined in `definedIn`: that file if writable,
+     *  else the most-leaf writable config (an override there beats a node_modules base). */
+    const targetFor = (definedIn) => {
+        const def = chain.find(c => c.path === definedIn);
+        return def?.writable ? def : mostLeafWritable;
+    };
+    const edit = (filePath, fn) => {
         let text;
         try {
-            text = fs.readFileSync(cand.path, 'utf-8');
+            text = fs.readFileSync(filePath, 'utf-8');
         }
         catch {
-            continue;
+            return false;
         }
-        const patched = insertCompilerOption(text, 'ignoreDeprecations', valueLiteral);
-        if (!patched)
-            continue;
+        const patched = fn(text);
+        if (patched == null || patched === text)
+            return false;
         try {
-            fs.writeFileSync(cand.path, patched);
-            const where = path.relative(cwd, cand.path) || 'tsconfig.json';
-            console.log(colors.cyan(`  Patched ${where}: added "ignoreDeprecations": ${valueLiteral} (silences TS6 removed-in-TS7 deprecation errors)`));
-            recordBuildIssue(chain[0].parsed?.name || path.basename(cwd), 'warning', `Deprecated compilerOptions silenced via ignoreDeprecations=${version}. Migrate moduleResolution to "node16"/"nodenext"/"bundler" before TypeScript 7.`);
+            fs.writeFileSync(filePath, patched);
             return true;
         }
         catch (error) {
-            console.error(colors.yellow(`  Could not write tsconfig patch (${cand.path}): ${error.message}`));
+            console.error(colors.yellow(`  Could not write tsconfig patch (${filePath}): ${error.message}`));
+            return false;
+        }
+    };
+    const note = (msg) => console.log(colors.cyan(`  ${msg}`));
+    let changed = false;
+    // moduleResolution: node/node10/classic → nodenext (+ align module).
+    const mr = effectiveCompilerOption(chain, 'moduleResolution');
+    if (mr && typeof mr.value === 'string' && DEPRECATED_MODULE_RESOLUTION.has(mr.value.toLowerCase())) {
+        const tgt = targetFor(mr.definedIn);
+        if (tgt && edit(tgt.path, t => upsertCompilerOption(t, 'moduleResolution', '"nodenext"'))) {
+            changed = true;
+            note(`Migrated moduleResolution "${mr.value}" → "nodenext" in ${path.relative(cwd, tgt.path) || 'tsconfig.json'}`);
+            // nodenext resolution requires a matching module setting.
+            const mod = effectiveCompilerOption(chain, 'module');
+            const modOk = mod && typeof mod.value === 'string' && /^(node16|nodenext|preserve)$/i.test(mod.value);
+            if (!modOk) {
+                const modTgt = mod ? targetFor(mod.definedIn) : mostLeafWritable;
+                if (modTgt && edit(modTgt.path, t => upsertCompilerOption(t, 'module', '"nodenext"'))) {
+                    note(`Aligned module → "nodenext" (required by moduleResolution "nodenext")`);
+                }
+            }
+            recordBuildIssue(name, 'warning', `Migrated moduleResolution "${mr.value}" → "nodenext". Verify relative imports resolve (NodeNext requires explicit file extensions on relative specifiers).`);
+        }
+    }
+    // target: es3 → es2022 (es3 is removed in TS7).
+    const tg = effectiveCompilerOption(chain, 'target');
+    if (tg && typeof tg.value === 'string' && tg.value.toLowerCase() === 'es3') {
+        const tgt = targetFor(tg.definedIn);
+        if (tgt && edit(tgt.path, t => upsertCompilerOption(t, 'target', '"es2022"'))) {
+            changed = true;
+            note(`Raised target "es3" → "es2022" in ${path.relative(cwd, tgt.path) || 'tsconfig.json'}`);
+        }
+    }
+    // Dead boolean flags: delete where writable; report when inherited from a base.
+    for (const flag of DEPRECATED_TS7_FLAGS) {
+        const f = effectiveCompilerOption(chain, flag);
+        if (!f)
+            continue;
+        const def = chain.find(c => c.path === f.definedIn);
+        if (def?.writable) {
+            if (edit(def.path, t => removeCompilerOptionLine(t, flag))) {
+                changed = true;
+                note(`Removed deprecated flag "${flag}" from ${path.relative(cwd, def.path) || 'tsconfig.json'}`);
+            }
+        }
+        else {
+            recordBuildIssue(name, 'warning', `Deprecated flag "${flag}" is inherited from ${path.relative(cwd, f.definedIn)} (a node_modules base) — remove it there before TypeScript 7.`);
         }
     }
-    return false;
+    return changed;
 }
 /** Build a single project: detect tsconfig, prompt to add `build: tsc` if a
  *  TypeScript project lacks a build script, run `npm run build`, record
@@ -2192,12 +2280,12 @@ export async function buildProject(cwd, opts = {}) {
     console.log(`Building ${pkg.name || cwd}...`);
     let buildResult = await runCommandAsync('npm', ['run', 'build'], { cwd, silent: true });
     if (!buildResult.success) {
-        // TS6 deprecation error (removed-in-TS7): apply the version TS itself names
-        // in `"ignoreDeprecations": "<v>"` and retry once.
+        // TS6 deprecation error (removed-in-TS7): perform the real migration
+        // (moduleResolution→nodenext, raise target, drop dead flags) and retry once.
+        // We don't silence with ignoreDeprecations — the retry may now surface real
+        // resolution errors, which are genuine bugs to fix, not deprecations.
         const out = (buildResult.stderr || '') + (buildResult.output || '');
-        const dep = out.match(/error TS510[17]\b/) &&
-            out.match(/['"]ignoreDeprecations['"]\s*:\s*['"]([\d.]+)['"]/);
-        if (dep && ensureTsconfigIgnoreDeprecations(cwd, dep[1])) {
+        if (/error TS510[17]\b/.test(out) && migrateTsconfigDeprecations(cwd)) {
             buildResult = await runCommandAsync('npm', ['run', 'build'], { cwd, silent: true });
         }
     }
@@ -2259,6 +2347,136 @@ export async function buildFileDepsTopologically(cwd, opts = {}, visited = new S
     }
     return allOk;
 }
+/** `moduleResolution` values TypeScript 6 deprecated and TypeScript 7 removes. */
+const DEPRECATED_MODULE_RESOLUTION = new Set(['node', 'node10', 'classic']);
+/** Compiler flags TypeScript deprecated (TS5101) and will remove in TS7. Their
+ *  mere presence — at any value — is a migration item. */
+const DEPRECATED_TS7_FLAGS = [
+    'charset', 'importsNotUsedAsValues', 'keyofStringsOnly', 'noImplicitUseStrict',
+    'noStrictGenericChecks', 'out', 'preserveValueImports',
+    'suppressExcessPropertyErrors', 'suppressImplicitAnyIndexErrors',
+];
+/** First defined value of `key` across the resolved chain (leaf overrides base),
+ *  plus which file in the chain defined it. */
+function effectiveCompilerOption(chain, key) {
+    for (const c of chain) {
+        const v = c.parsed?.compilerOptions?.[key];
+        if (v !== undefined)
+            return { value: v, definedIn: c.path };
+    }
+    return null;
+}
+/** Expand one npm `workspaces` pattern (relative to `baseDir`) to package dirs.
+ *  Handles an explicit path and a single-level `<prefix>/*` glob — the common
+ *  cases; deep `**` globs aren't expanded. */
+function expandWorkspacePattern(baseDir, pattern) {
+    if (!pattern.includes('*')) {
+        const d = path.resolve(baseDir, pattern);
+        return fs.existsSync(path.join(d, 'package.json')) ? [d] : [];
+    }
+    const prefix = pattern.slice(0, pattern.indexOf('*')).replace(/[\\/]$/, '');
+    const parent = path.resolve(baseDir, prefix);
+    try {
+        return fs.readdirSync(parent, { withFileTypes: true })
+            .filter(e => e.isDirectory())
+            .map(e => path.join(parent, e.name))
+            .filter(d => fs.existsSync(path.join(d, 'package.json')));
+    }
+    catch {
+        return [];
+    }
+}
+/** Collect this package and every package reachable through `file:` deps AND
+ *  npm `workspaces` members (the same graph the build cascade walks). Returns a
+ *  set of absolute dirs. */
+function collectFileDepDirs(cwd, visited = new Set()) {
+    const abs = path.resolve(cwd);
+    if (visited.has(abs))
+        return visited;
+    visited.add(abs);
+    let pkg;
+    try {
+        pkg = readPackageJson(cwd);
+    }
+    catch {
+        return visited;
+    }
+    for (const key of ['dependencies', 'devDependencies']) {
+        const deps = pkg?.[key];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [, spec] of Object.entries(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const target = path.resolve(cwd, spec.slice('file:'.length));
+            if (!fs.existsSync(path.join(target, 'package.json')))
+                continue;
+            collectFileDepDirs(target, visited);
+        }
+    }
+    // Workspace members (referenced via the `workspaces` field, not file: deps).
+    const ws = Array.isArray(pkg?.workspaces) ? pkg.workspaces : pkg?.workspaces?.packages;
+    if (Array.isArray(ws)) {
+        for (const pattern of ws) {
+            if (typeof pattern !== 'string')
+                continue;
+            for (const memberDir of expandWorkspacePattern(cwd, pattern))
+                collectFileDepDirs(memberDir, visited);
+        }
+    }
+    return visited;
+}
+/** Report-only TS7-readiness scan over `cwd` and its `file:` dep graph. For each
+ *  package with a tsconfig it resolves the *effective* compilerOptions through the
+ *  `extends` chain and flags removed-in-TS7 settings (deprecated `moduleResolution`,
+ *  `target: es3`, and the deprecated boolean flags) plus any `ignoreDeprecations`
+ *  (itself a flagged bug — it silences a real TS7 error). Reads only — never writes.
+ *  The same migration `migrateTsconfigDeprecations` applies automatically on a build
+ *  failure; this report is the read-only, whole-graph inventory. */
+export function reportTs7Deprecations(cwd) {
+    const dirs = collectFileDepDirs(cwd);
+    const findings = [];
+    for (const dir of dirs) {
+        const tsconfigPath = path.join(dir, 'tsconfig.json');
+        if (!fs.existsSync(tsconfigPath))
+            continue;
+        const { chain } = resolveTsconfigChain(tsconfigPath);
+        if (!chain.length)
+            continue;
+        let name;
+        try {
+            name = readPackageJson(dir).name || path.basename(dir);
+        }
+        catch {
+            name = path.basename(dir);
+        }
+        const rel = (p) => path.relative(dir, p) || 'tsconfig.json';
+        // Any ignoreDeprecations is itself a latent bug: it silences a real,
+        // removed-in-TS7 error rather than fixing it. Flag it, loudly.
+        const igd = effectiveCompilerOption(chain, 'ignoreDeprecations');
+        if (igd !== null) {
+            findings.push({ name, dir, option: 'ignoreDeprecations', value: String(igd.value), definedIn: rel(igd.definedIn),
+                action: 'REMOVE — silences a real TS7-removal error instead of fixing it; a bug waiting to bite at TS7. Fix the underlying option(s) below, then delete this.' });
+        }
+        const mr = effectiveCompilerOption(chain, 'moduleResolution');
+        if (mr && typeof mr.value === 'string' && DEPRECATED_MODULE_RESOLUTION.has(mr.value.toLowerCase())) {
+            findings.push({ name, dir, option: 'moduleResolution', value: mr.value, definedIn: rel(mr.definedIn),
+                action: 'migrate to "node16" / "nodenext" / "bundler" (validate import resolution)' });
+        }
+        const tgt = effectiveCompilerOption(chain, 'target');
+        if (tgt && typeof tgt.value === 'string' && tgt.value.toLowerCase() === 'es3') {
+            findings.push({ name, dir, option: 'target', value: tgt.value, definedIn: rel(tgt.definedIn),
+                action: 'raise target — "es3" is removed in TS7' });
+        }
+        for (const flag of DEPRECATED_TS7_FLAGS) {
+            const f = effectiveCompilerOption(chain, flag);
+            if (f)
+                findings.push({ name, dir, option: flag, value: String(f.value), definedIn: rel(f.definedIn),
+                    action: 'remove — deprecated flag, removed in TS7' });
+        }
+    }
+    return findings;
+}
 /** Ensure the workspace-root `node_modules/` is in sync with every member's
  *  declared deps. Workspaces hoist deps to the root, so a dep added to any
  *  member `package.json` without a follow-up `npm install` at the root leaves
@@ -2292,19 +2510,244 @@ export async function ensureWorkspaceDepModules(rootDir, members, verbose = fals
         await suggestPnpmOnInstallFailure(`ensureWorkspaceDepModules: ${root}`);
     }
 }
+/** Extract the lines a human needs from a failed npm command's output: the
+ *  `npm error` lines minus stack frames and brace-only object-dump fragments,
+ *  deduped. The full output belongs in a log file (saveNpmLog), not the terminal. */
+export function distillNpmErrors(combined) {
+    const key = [];
+    const seen = new Set();
+    for (const raw of combined.split('\n')) {
+        const m = raw.trimEnd().match(/^npm (?:error|ERR!)\s?(.*)$/);
+        if (!m || !m[1])
+            continue;
+        const msg = m[1];
+        if (/^\s*at /.test(msg))
+            continue; // stack frames
+        if (/^[\s{}\[\]),]*$/.test(msg))
+            continue; // object-dump punctuation lines
+        if (seen.has(msg))
+            continue;
+        seen.add(msg);
+        key.push(msg);
+    }
+    return key.slice(0, 12);
+}
+/** Write the full output of a failed npm command to a log file under the temp
+ *  dir and return its path (null if the write itself fails). */
+function saveNpmLog(label, content) {
+    try {
+        const dir = path.join(os.tmpdir(), 'npmglobalize-logs');
+        fs.mkdirSync(dir, { recursive: true });
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const file = path.join(dir, `${label.replace(/[^a-z0-9.@-]+/gi, '_')}-${stamp}.log`);
+        fs.writeFileSync(file, content);
+        return file;
+    }
+    catch {
+        return null;
+    }
+}
+/** True if `dir` contains a browser executable somewhere below it. A healthy
+ *  puppeteer browser folder always has one; a truncated extraction doesn't
+ *  (extraction writes the small metadata files first — manifest, ABOUT,
+ *  licenses — so an interrupted one holds only those). */
+function containsBrowserExecutable(dir) {
+    try {
+        for (const entry of fs.readdirSync(dir, { recursive: true })) {
+            const name = String(entry);
+            if (process.platform === 'win32' ? /\.exe$/i.test(name) : /(^|[\\/])(chrome|chrome-headless-shell|firefox)$/.test(name))
+                return true;
+        }
+    }
+    catch {
+        // unreadable — treat as not-a-healthy-browser; caller only acts on puppeteer cache paths
+    }
+    return false;
+}
+/** Extract a puppeteer browser archive with the SYSTEM unzipper into a fresh
+ *  version folder. Workaround for a third-party bug: puppeteer's installer
+ *  unpacks zips with the `extract-zip` package, which on Node 26 silently
+ *  truncates — its promise never resolves, the event loop drains, and the
+ *  process exits 0 after writing only the first few small files. The download
+ *  itself is fine (and the archive is left behind, since the hung promise
+ *  means puppeteer's cleanup never runs), so completing the extraction
+ *  ourselves both repairs the folder and converges where delete-and-retry
+ *  cannot. TODO: drop this when puppeteer/extract-zip fix Node 26 extraction. */
+function extractBrowserArchive(archivePath, folder) {
+    // Git-Bash puts GNU tar (no zip support) first on PATH — use bsdtar
+    // explicitly on Windows; macOS tar is bsdtar; Linux needs unzip.
+    const [cmd, args] = process.platform === 'win32'
+        ? [path.join(process.env.SystemRoot || 'C:\\WINDOWS', 'system32', 'tar.exe'), ['-xf', archivePath, '-C', folder]]
+        : process.platform === 'darwin'
+            ? ['tar', ['-xf', archivePath, '-C', folder]]
+            : ['unzip', ['-oq', archivePath, '-d', folder]];
+    try {
+        fs.rmSync(folder, { recursive: true, force: true });
+        fs.mkdirSync(folder, { recursive: true });
+        const r = spawnSafe(cmd, args, { stdio: 'pipe', encoding: 'utf-8' });
+        return r.status === 0 && containsBrowserExecutable(folder);
+    }
+    catch {
+        return false;
+    }
+}
+/** Scan a puppeteer browser cache (layout <root>/<browser>/<platform-version>)
+ *  and repair every version folder that has no browser executable in it — the
+ *  residue of a truncated extraction (see extractBrowserArchive for the Node
+ *  26 extract-zip bug that produces these). Per corrupt folder:
+ *  1. If the downloaded archive still sits next to it (the usual case right
+ *     after a truncating run — the hung extraction means puppeteer's cleanup
+ *     never deleted it), finish the extraction with the system unzipper. This
+ *     is the only path that converges on Node 26, where re-extraction by
+ *     puppeteer truncates again every time.
+ *  2. Otherwise delete the folder so the next attempt re-downloads.
+ *
+ *  Timing matters: a truncating install EXITS 0, so the poisoned cache hides
+ *  behind a successful install — and the NEXT install deletes the leftover
+ *  archive before erroring. So this must run right after a SUCCESSFUL install
+ *  (while the archive is still there), not only on failure. */
+export function verifyPuppeteerCache(cacheRoot) {
+    const root = cacheRoot || process.env.PUPPETEER_CACHE_DIR || path.join(os.homedir(), '.cache', 'puppeteer');
+    const result = { repaired: [], removed: [] };
+    let browserDirs;
+    try {
+        browserDirs = fs.readdirSync(root, { withFileTypes: true }).filter(d => d.isDirectory());
+    }
+    catch {
+        return result; // no puppeteer cache — nothing to verify
+    }
+    for (const browser of browserDirs) {
+        const browserDir = path.join(root, browser.name);
+        let entries;
+        try {
+            entries = fs.readdirSync(browserDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            // version folders look like win64-148.0.7778.97 / mac_arm-131.0.6778.204
+            if (!entry.isDirectory() || !/^[a-z0-9_]+-[\d.]+$/i.test(entry.name))
+                continue;
+            const folder = path.join(browserDir, entry.name);
+            if (containsBrowserExecutable(folder))
+                continue;
+            try {
+                // archive sits next to the version folder, named e.g.
+                // chrome/148.0.7778.97-chrome-win64.zip for chrome/win64-148.0.7778.97
+                const version = entry.name.slice(entry.name.indexOf('-') + 1);
+                const archive = entries.find(e => e.isFile() && e.name.startsWith(`${version}-`) && e.name.endsWith('.zip'))?.name;
+                if (archive && extractBrowserArchive(path.join(browserDir, archive), folder)) {
+                    fs.rmSync(path.join(browserDir, archive), { force: true }); // puppeteer's own cleanup never ran
+                    result.repaired.push(folder);
+                    continue;
+                }
+                fs.rmSync(folder, { recursive: true, force: true });
+                result.removed.push(folder);
+            }
+            catch {
+                // couldn't repair or delete (locked?) — leave it; install will report it
+            }
+        }
+    }
+    return result;
+}
+/** Detect puppeteer's corrupted-browser-cache failure ("browser folder exists
+ *  but the executable is missing") in failed install output and repair the
+ *  whole cache it points into (verifyPuppeteerCache — the installer checks
+ *  browsers in parallel and only reports the first corrupt one, so siblings
+ *  are usually poisoned too). Returns the folders repaired or removed. */
+export function fixPuppeteerCorruptedCache(combined) {
+    for (const m of combined.matchAll(/The browser folder \((.+?)\) exists but the executable \((.+?)\) is missing/g)) {
+        const folder = m[1];
+        // Only ever touch a puppeteer cache — never an arbitrary path parsed from output
+        if (!/[\\/]puppeteer[\\/]/i.test(folder))
+            continue;
+        // cache layout is <root>/<browser>/<platform-version>
+        return verifyPuppeteerCache(path.dirname(path.dirname(folder)));
+    }
+    return { repaired: [], removed: [] };
+}
+/** npm 11.17+ gates lifecycle scripts behind `allowScripts` — non-covered
+ *  scripts are skipped and the install still exits 0. A skipped postinstall
+ *  can leave the package broken at runtime (puppeteer without its browser,
+ *  native modules unbuilt), so surface the warning instead of burying it in
+ *  the captured output. */
+function warnSkippedScripts(combined) {
+    const pkgs = [...combined.matchAll(/^npm warn allow-scripts\s+(\S+@[^\s(]+) \(/gm)];
+    if (!pkgs.length)
+        return;
+    const names = pkgs.map(m => m[1].replace(/@[^@]+$/, ''));
+    console.log(colors.yellow(`  ⚠ npm skipped install scripts (allowScripts): ${pkgs.map(m => m[1]).join(', ')}`));
+    console.log(colors.yellow(`    Package may be broken at runtime. Allow with: npm config set allow-scripts=${names.join(',')} --location=user`));
+}
 /** Run npm install -g with retries for registry propagation delay.
  *  Brand-new packages (first-time publish) take much longer to become
  *  installable than version bumps, so we use longer waits and more
- *  attempts when `isNewPackage` is true. */
+ *  attempts when `isNewPackage` is true.
+ *
+ *  Output is captured, not streamed: npm failures produce hundreds of lines
+ *  (cleanup warns, stack traces, object dumps). The terminal gets a distilled
+ *  error summary; the full text of all attempts goes to a log file.
+ *  Known-fixable failures (puppeteer's corrupted browser cache) are repaired
+ *  automatically and granted one immediate bonus retry. */
 async function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRetries) {
     const retries = maxRetries ?? (isNewPackage ? 6 : 3);
     const delaySec = isNewPackage ? 30 : 10;
-    let result = await runCommandAsync('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
-    for (let attempt = 1; attempt < retries && !result.success; attempt++) {
+    let fullLog = '';
+    let result = { success: false, output: '', stderr: '' };
+    let attempt = 0;
+    let cacheFixRounds = 0;
+    while (true) {
+        console.log(colors.cyan(`> npm install -g ${pkgSpec}`));
+        result = await runCommandAsync('npm', ['install', '-g', pkgSpec], { cwd, silent: true });
+        const combined = `${result.output}\n${result.stderr}`;
+        fullLog += `===== attempt ${attempt + 1}: npm install -g ${pkgSpec} =====\n${combined}\n`;
+        if (result.success) {
+            const added = combined.match(/^added \d+ packages?.*$/m);
+            if (added)
+                console.log(colors.dim(`  ${added[0]}`));
+            warnSkippedScripts(combined);
+            // A truncated puppeteer browser extraction exits 0, so the install
+            // LOOKS fine while the cache is poisoned for every future install.
+            // Verify now, while the leftover archive still allows a repair.
+            const verify = verifyPuppeteerCache();
+            for (const folder of verify.repaired)
+                console.log(colors.yellow(`  ↻ Repaired truncated puppeteer browser extraction (from cached archive): ${folder}`));
+            for (const folder of verify.removed)
+                console.log(colors.yellow(`  ↻ Removed corrupted puppeteer browser cache (no archive to repair from — will re-download when needed): ${folder}`));
+            return result;
+        }
+        const cleanupFails = (combined.match(/npm warn cleanup\s+\[Error: EPERM/g) || []).length;
+        if (cleanupFails)
+            console.log(colors.dim(`  (npm couldn't remove ${cleanupFails} leftover dir(s) — EPERM cleanup warnings, details in log)`));
+        for (const line of distillNpmErrors(combined))
+            console.error(colors.red(`  ${line}`));
+        // Known-fixable failure: repair and retry immediately — the cause is
+        // local, so waiting for registry propagation is pointless. Puppeteer
+        // reports one corrupted browser per run, so allow a few repair rounds
+        // (each must actually repair or remove a folder to earn another retry).
+        if (cacheFixRounds < 3) {
+            const fix = fixPuppeteerCorruptedCache(combined);
+            if (fix.repaired.length || fix.removed.length) {
+                cacheFixRounds++;
+                for (const folder of fix.repaired)
+                    console.log(colors.yellow(`  ↻ Repaired corrupted puppeteer browser cache (extracted cached archive): ${folder}`));
+                for (const folder of fix.removed)
+                    console.log(colors.yellow(`  ↻ Removed corrupted puppeteer browser cache (will re-download): ${folder}`));
+                console.log(colors.yellow(`    (puppeteer's extract-zip truncates silently on Node 26, leaving folders without executables) — retrying now`));
+                continue;
+            }
+        }
+        attempt++;
+        if (attempt >= retries)
+            break;
         console.log(colors.yellow(`  Retrying install (attempt ${attempt + 1}/${retries}) in ${delaySec} seconds...`));
         sleepSync(delaySec * 1000);
-        result = await runCommandAsync('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
     }
+    const logFile = saveNpmLog(`install-${pkgSpec === '.' ? path.basename(cwd) : pkgSpec}`, fullLog);
+    if (logFile)
+        console.error(colors.dim(`  Full npm output: ${logFile}`));
     return result;
 }
 /** Run a command and return success status */
@@ -2439,36 +2882,133 @@ function dumpPackCtrlcDiagnostics(pkg, cwd, packOutput, packStderr) {
 /** Install a package globally in WSL, auto-fixing the root-owned /usr/local/lib/node_modules
  *  EACCES case by switching npm to a user prefix (~/.npm-global) and retrying once.
  *  Output is captured (so we can scan for the error) and then mirrored to the terminal. */
+/** Pull the install spec (e.g. `@scope/name@1.2.3`) out of WSL install args.
+ *  Returns null for a local-dir install (`.`) or when no spec is present —
+ *  those can't 404 on registry propagation. */
+function extractWslInstallSpec(wslArgs) {
+    const idx = wslArgs.findIndex(a => a === 'install' || a === 'i');
+    if (idx === -1)
+        return null;
+    for (const a of wslArgs.slice(idx + 1)) {
+        if (a.startsWith('-'))
+            continue; // flag
+        if (a === '.' || a === './')
+            return null; // local dir install
+        return a; // first positional = the spec
+    }
+    return null;
+}
+/** Is WSL's npm authenticated to the registry? (npm masks a private-package 401
+ *  as a 404, so a WSL install can fail with E404 purely because WSL's token is
+ *  stale/missing while Windows' token is fine.) */
+async function isWslNpmAuthed() {
+    const r = await runCommandAsync('wsl', ['npm', 'whoami'], { silent: true });
+    return r.success && (r.output || '').trim().length > 0;
+}
+/** Copy the current Windows npm authToken into WSL's npm config. WSL keeps its
+ *  own `~/.npmrc` (separate `/home/<user>`), so a token rotated on Windows leaves
+ *  WSL stale → private installs 404. Uses `wsl npm config set` (argv passed
+ *  directly via spawn — no shell-quoting hazards). Returns true if a token was
+ *  found on Windows and the set command succeeded. */
+async function syncNpmTokenToWsl() {
+    let token;
+    try {
+        const winNpmrc = path.join(os.homedir(), '.npmrc');
+        token = fs.readFileSync(winNpmrc, 'utf8').match(/\/\/registry\.npmjs\.org\/:_authToken=(\S+)/)?.[1];
+    }
+    catch {
+        return false;
+    }
+    if (!token)
+        return false;
+    const r = await runCommandAsync('wsl', ['npm', 'config', 'set', `//registry.npmjs.org/:_authToken=${token}`], { silent: true });
+    return r.success;
+}
+/** Poll the npm registry *from inside WSL* until `spec` resolves there. The
+ *  Windows-side `waitForNpmVersion` can report "ready" while WSL's npm still
+ *  hits a CDN edge that 404s — so for a WSL install we must confirm visibility
+ *  in WSL's own view before retrying. */
+async function waitForNpmVersionInWsl(spec, maxWaitMs = 180000) {
+    const interval = 10000;
+    const maxAttempts = Math.ceil(maxWaitMs / interval);
+    process.stdout.write(`${timestamp()} Waiting for ${spec} on npm registry (WSL view)`);
+    for (let i = 0; i < maxAttempts; i++) {
+        const r = await runCommandAsync('wsl', ['npm', 'view', spec, 'version'], { silent: true });
+        if (r.success && (r.output || '').trim()) {
+            process.stdout.write(' ready\n');
+            return true;
+        }
+        process.stdout.write('.');
+        await new Promise(resolve => setTimeout(resolve, interval));
+    }
+    process.stdout.write(' timed out\n');
+    return false;
+}
 export async function installInWsl(wslArgs, opts = {}) {
-    console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
-    let result = await runCommandAsync('wsl', wslArgs, { cwd: opts.cwd, silent: true });
-    if (result.output)
-        process.stdout.write(result.output);
-    if (result.stderr)
-        process.stderr.write(result.stderr);
+    const runOnce = async () => {
+        console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
+        const r = await runCommandAsync('wsl', wslArgs, { cwd: opts.cwd, silent: true });
+        if (r.output)
+            process.stdout.write(r.output);
+        if (r.stderr)
+            process.stderr.write(r.stderr);
+        return r;
+    };
+    let result = await runOnce();
     if (result.success)
         return { success: true, fixed: false };
-    const combined = (result.output || '') + '\n' + (result.stderr || '');
-    const permIssue = /EACCES/.test(combined) && /\/usr\/(?:local\/)?lib\/node_modules/.test(combined);
-    if (!permIssue)
-        return { success: false, fixed: false };
-    console.log(colors.yellow('Detected root-owned npm prefix in WSL — switching to ~/.npm-global and retrying...'));
-    const fix = `set -e; npm config set prefix "$HOME/.npm-global"; mkdir -p "$HOME/.npm-global/bin"; if ! grep -q '\\.npm-global/bin' "$HOME/.bashrc" 2>/dev/null; then printf '\\n# npm user-prefix bin (added by npmglobalize)\\nexport PATH="$HOME/.npm-global/bin:$PATH"\\n' >> "$HOME/.bashrc"; fi`;
-    const fixResult = await runCommandAsync('wsl', ['bash', '-lc', fix], { silent: true });
-    if (!fixResult.success) {
-        console.error(colors.red('Failed to apply WSL npm prefix fix:'));
-        if (fixResult.stderr)
-            process.stderr.write(fixResult.stderr);
-        return { success: false, fixed: false };
-    }
-    console.log(colors.green('✓ WSL npm prefix set to ~/.npm-global; PATH appended to ~/.bashrc'));
-    console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
-    result = await runCommandAsync('wsl', wslArgs, { cwd: opts.cwd, silent: true });
-    if (result.output)
-        process.stdout.write(result.output);
-    if (result.stderr)
-        process.stderr.write(result.stderr);
-    return { success: result.success, fixed: result.success };
+    let combined = (result.output || '') + '\n' + (result.stderr || '');
+    // EACCES on a root-owned npm prefix → switch to a user prefix and retry.
+    if (/EACCES/.test(combined) && /\/usr\/(?:local\/)?lib\/node_modules/.test(combined)) {
+        console.log(colors.yellow('Detected root-owned npm prefix in WSL — switching to ~/.npm-global and retrying...'));
+        const fix = `set -e; npm config set prefix "$HOME/.npm-global"; mkdir -p "$HOME/.npm-global/bin"; if ! grep -q '\\.npm-global/bin' "$HOME/.bashrc" 2>/dev/null; then printf '\\n# npm user-prefix bin (added by npmglobalize)\\nexport PATH="$HOME/.npm-global/bin:$PATH"\\n' >> "$HOME/.bashrc"; fi`;
+        const fixResult = await runCommandAsync('wsl', ['bash', '-lc', fix], { silent: true });
+        if (!fixResult.success) {
+            console.error(colors.red('Failed to apply WSL npm prefix fix:'));
+            if (fixResult.stderr)
+                process.stderr.write(fixResult.stderr);
+            return { success: false, fixed: false };
+        }
+        console.log(colors.green('✓ WSL npm prefix set to ~/.npm-global; PATH appended to ~/.bashrc'));
+        result = await runOnce();
+        if (result.success)
+            return { success: true, fixed: true };
+        combined = (result.output || '') + '\n' + (result.stderr || '');
+    }
+    // E404 on a scoped package has TWO causes, and npm gives the same error for
+    // both (it masks a private-package 401 as 404):
+    //   (a) WSL's npm token is stale/missing (Windows is authed, WSL isn't), or
+    //   (b) genuine registry propagation lag for a just-published version.
+    // Distinguish via `wsl npm whoami` and apply the matching fix.
+    if (/E404|404 Not Found/.test(combined)) {
+        const spec = extractWslInstallSpec(wslArgs);
+        if (!(await isWslNpmAuthed())) {
+            // (a) Auth: sync the Windows token into WSL, then retry.
+            console.log(colors.yellow("WSL's npm isn't authenticated (stale/missing token) — syncing your Windows npm token to WSL..."));
+            if (await syncNpmTokenToWsl() && await isWslNpmAuthed()) {
+                console.log(colors.green('✓ Synced npm token to WSL'));
+                result = await runOnce();
+                if (result.success)
+                    return { success: true, fixed: true };
+            }
+            else {
+                console.error(colors.yellow('  Could not authenticate WSL npm. Run `wsl npm login` (or sync your ~/.npmrc token) and retry.'));
+            }
+        }
+        else if (spec) {
+            // (b) Propagation: WSL is authed but the version isn't visible there yet.
+            console.log(colors.yellow(`WSL npm can't see ${spec} yet — registry propagation lag (Windows already saw it). Waiting in WSL...`));
+            if (await waitForNpmVersionInWsl(spec)) {
+                result = await runOnce();
+                if (result.success)
+                    return { success: true, fixed: true };
+            }
+            else {
+                console.error(colors.yellow(`  ${spec} still not visible to WSL's npm after waiting — try the WSL install again shortly.`));
+            }
+        }
+    }
+    return { success: false, fixed: false };
 }
 /** Diagnose common build/version failure patterns and print actionable hints.
  *  Returns true if a diagnosis was printed. */
@@ -2562,12 +3102,14 @@ function diagnoseBuildFailure(errorText, cwd) {
         diagnosed = true;
     }
     // Pattern: TS6 made deprecated options (moduleResolution=node10, ...) hard errors,
-    // removed in TS7. (Safety net for when the auto ignoreDeprecations patch+retry didn't fire.)
+    // removed in TS7. (Safety net for when the auto-migration patch+retry didn't fire —
+    // e.g. an unresolved chain or a non-writable base.)
     if (!diagnosed && /error TS510[17]\b/.test(errorText)) {
-        const v = errorText.match(/['"]ignoreDeprecations['"]\s*:\s*['"]([\d.]+)['"]/);
-        console.error(colors.yellow('\n  Hint: TypeScript 6 flags long-deprecated options that TS7 will remove.'));
-        console.error(colors.yellow(`  Bridge: add  "ignoreDeprecations": "${v ? v[1] : '6.0'}"  to compilerOptions (shared base in a workspace).`));
-        console.error(colors.yellow('  Real fix before TS7: migrate moduleResolution to "node16"/"nodenext"/"bundler".'));
+        console.error(colors.yellow('\n  Hint: TypeScript 6 flags long-deprecated options that TS7 removes.'));
+        console.error(colors.yellow('  Fix (do NOT use "ignoreDeprecations" — that only hides the error until TS7):'));
+        console.error(colors.yellow('    • moduleResolution "node10"/"node"/"classic" → "nodenext" (set module to "nodenext" too).'));
+        console.error(colors.yellow('    • target "es3" → "es2022";  remove dead flags (importsNotUsedAsValues, out, …).'));
+        console.error(colors.yellow('  Run  npmglobalize -ts7-report  for the full per-package list.'));
         diagnosed = true;
     }
     // Pattern: TypeScript compilation error
@@ -5206,7 +5748,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 if (pkg.bin && (install || link || wsl)) {
                     if (link) {
                         console.log(`Installing ${pkgName} globally from local directory (link)...`);
-                        const localInstallResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                        const localInstallResult = await installGlobalWithRetry('.', cwd, false, 1);
                         if (localInstallResult.success) {
                             console.log(colors.green(`✓ Linked globally: ${pkgName}@${pkgVersion}`));
                         }
@@ -5221,7 +5763,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                         // sibling imports. Local install handles workspace linking correctly.
                         if (pkg.workspaces) {
                             console.log(`Installing ${pkgName}@${pkgVersion} globally from local (workspace)...`);
-                            const localResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                            const localResult = await installGlobalWithRetry('.', cwd, false, 1);
                             if (localResult.success) {
                                 console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
                             }
@@ -5260,7 +5802,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                             else {
                                 console.log(colors.yellow(`${pkgName}@${pkgVersion} not found on npm — installing from local directory.`));
                                 console.log(colors.dim('  Use -m "message" to publish this version to npm.'));
-                                const localResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                                const localResult = await installGlobalWithRetry('.', cwd, false, 1);
                                 if (localResult.success) {
                                     console.log(colors.green(`✓ Installed globally from local: ${pkgName}@${pkgVersion}`));
                                 }
@@ -6044,7 +6586,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (link) {
             console.log(`Linking globally: ${pkgName}@${pkgVersion}...`);
             if (!dryRun) {
-                const installResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                const installResult = await installGlobalWithRetry('.', cwd, false, 1);
                 if (installResult.success) {
                     globalInstallOk = true;
                     console.log(colors.green(`✓ Linked globally: ${pkgName}@${pkgVersion}`));
@@ -6064,7 +6606,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 // Workspace packages: install from local for proper workspace linking
                 console.log(`Installing ${pkgName}@${pkgVersion} globally from local (workspace)...`);
                 if (!dryRun) {
-                    const installResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                    const installResult = await installGlobalWithRetry('.', cwd, false, 1);
                     if (installResult.success) {
                         globalInstallOk = true;
                         console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
@@ -6625,7 +7167,7 @@ export async function globalizeWorkspace(rootDir, options = {}, configOptions =
             // Workspace root is private — always install from local directory
             console.log(`Installing ${pkgName}@${pkgVersion} globally from local directory...`);
             if (!dryRun) {
-                const installResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd: rootDir, silent: false, showCommand: true });
+                const installResult = await installGlobalWithRetry('.', rootDir, false, 1);
                 if (installResult.success) {
                     console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.191",
+  "version": "1.0.193",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",