@bobfrankston/npmglobalize 1.0.196 → 1.0.198

package/README.md

@@ -532,6 +532,45 @@ not yet change its behavior based on it. Behavior wiring (e.g. resolving
 `file:` deps to the latest published npm version instead of walking siblings)
 is planned.
 
+### `upstream` — who consumes this package
+
+Bookkeeping, not a setting. When a package with `file:` deps publishes,
+npmglobalize appends an entry to each **dependency's** `.globalize.json5`:
+
+```json5
+{
+  "install": true,
+
+  // FYI: packages that depend on this one (immediate consumers,
+  //      recorded when each of them publishes). Nothing is updated
+  //      automatically; follow each path's own .globalize.json5 to
+  //      walk further out.
+  "upstream": [
+    {"path":"Y:\\dev\\utils\\winpos","version":"2.0.51","updated":"2026-08-09"},
+  ],
+}
+```
+
+So publishing `winpos` (which has `"@bobfrankston/msger": "file:../msgx/msger"`)
+records winpos in **msger's** config. Each entry carries the consumer's
+checkout path, its version at the time, and the date.
+
+Only **immediate** consumers are recorded. A full consumer tree is a walk, not
+a copy: follow each entry's path and read that package's own `upstream` list.
+
+The list is **FYI for now** — it is recorded, preserved across publishes, and
+printed in the Release Summary of the package that owns it. Nothing is
+rebuilt, republished, or reinstalled on its behalf. An entry is added the
+first time a consumer publishes after this feature landed, and refreshed in
+place on every publish after that.
+
+The entry is written into the dependency's own checkout, then committed there
+(`Record upstream <consumer>@<version>`) and pushed if that repo has a remote.
+Only `.globalize.json5` is staged and committed, by pathspec — anything else
+the dependency had staged or modified is left exactly as it was. If the
+dependency isn't a git repo, or ignores `.globalize.json5`, the file is still
+written and the commit is skipped.
+
 ## Common Workflows
 
 ### Standard Release

package/lib.d.ts

@@ -25,6 +25,16 @@ export declare function clearBuildIssues(): void;
 /** Extract the first TypeScript error line from build output for the summary.
  *  Returns a short string like "file.ts(42,5): error TS2339: Property 'foo' ..." */
 export declare function extractFirstTscError(output: string): string | null;
+/** One package that depends on this one, recorded in this package's
+ *  .globalize.json5 when that package publishes. */
+export interface UpstreamEntry {
+    /** Absolute path of the consumer's checkout */
+    path: string;
+    /** Consumer's version at the time it was recorded */
+    version: string;
+    /** Date the entry was last written (YYYY-MM-DD) */
+    updated: string;
+}
 /** Options for the globalize operation */
 export interface GlobalizeOptions {
     /** Bump type: patch (default), minor, major */
@@ -132,6 +142,12 @@ export interface GlobalizeOptions {
      *  that rely on workspace cross-refs / -public-deps cascade. Opt in when
      *  the assumption holds. */
     importCheck?: boolean;
+    /** Bookkeeping, not a CLI option: the packages that depend on this one,
+     *  written into this package's .globalize.json5 when each of them
+     *  publishes. Immediate consumers only - a full consumer tree is walked by
+     *  following each entry's own .globalize.json5. FYI for now: recorded and
+     *  displayed, nothing is updated automatically. */
+    upstream?: UpstreamEntry[];
     /** Internal: signals this call is from workspace orchestrator */
     /** Skip the upfront dep-graph prescan */
     noPrescan?: boolean;
@@ -289,6 +305,16 @@ export declare function prescanDepGraph(baseDir: string, visited?: Set<string>,
 export declare function restoreDeps(pkg: any, verbose?: boolean): boolean;
 /** Check if .dependencies exist (already transformed) */
 export declare function hasBackup(pkg: any): boolean;
+/** Record this package in the `upstream` list of each package it depends on
+ *  via file:, so a library knows who consumes it.
+ *
+ *  Immediate consumers only — each entry's own .globalize.json5 carries its
+ *  consumers, so the full tree is a walk rather than a copy. Nothing acts on
+ *  the list yet; it's FYI for a future "update my consumers" pass.
+ *
+ *  Best-effort: a dep whose config can't be written is reported and skipped,
+ *  never fatal - this runs after a successful publish. */
+export declare function recordUpstream(cwd: string, dryRun?: boolean, verbose?: boolean): Promise<void>;
 /** Get the latest git tag (if any) */
 export declare function getLatestGitTag(cwd: string): string | null;
 /** Check if a git tag exists */
@@ -457,6 +483,14 @@ export declare function fixPuppeteerCorruptedCache(combined: string): {
     repaired: string[];
     removed: string[];
 };
+/** Every package in `dir`'s dependency closure that shares its scope — our
+ *  own packages, published by this same tool. Walks node_modules for
+ *  transitive own-scope deps, since a cascade dep can carry its own
+ *  postinstall and only its installed copy lists its dependencies.
+ *
+ *  Returns [] for an unscoped package: there's no way to tell an unscoped
+ *  package of ours from a third-party one by name alone. */
+export declare function ownScopePackages(dir: string): string[];
 /** Run a command and return success status */
 export declare function runCommand(cmd: string, args: string[], options?: {
     silent?: boolean;

package/lib.js

@@ -240,6 +240,12 @@ export function writeConfig(dir, config, explicitKeys) {
     const existing = readConfig(dir);
     // Filter out temporary flags and default values (unless explicitly set)
     const filtered = {};
+    // upstream is bookkeeping written by recordUpstream, never a CLI option, so
+    // it isn't in the options object a normal publish passes here. Carry it
+    // across or this package's own next publish would erase its consumer list.
+    if (config.upstream === undefined && existing.upstream !== undefined) {
+        config = { ...config, upstream: existing.upstream };
+    }
     const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'publicDeps', 'forcePublish', 'once', 'cleanNestedModules']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
@@ -263,6 +269,19 @@ export function writeConfig(dir, config, explicitKeys) {
     const entries = Object.entries(filtered);
     if (entries.length > 0) {
         entries.forEach(([key, value]) => {
+            // upstream is a list of records - one per line beats one long line
+            if (key === 'upstream' && Array.isArray(value)) {
+                lines.push('  // FYI: packages that depend on this one (immediate consumers,');
+                lines.push('  //      recorded when each of them publishes). Nothing is updated');
+                lines.push('  //      automatically; follow each path\'s own .globalize.json5 to');
+                lines.push('  //      walk further out.');
+                lines.push('  "upstream": [');
+                for (const entry of value) {
+                    lines.push(`    ${JSON.stringify(entry)},`);
+                }
+                lines.push('  ],');
+                return;
+            }
             const jsonValue = typeof value === 'string' ? `"${value}"` : JSON.stringify(value);
             const comma = ','; // JSON5 allows trailing commas
             // Add inline comment for clarity
@@ -1541,6 +1560,117 @@ export function restoreDeps(pkg, verbose = false) {
 export function hasBackup(pkg) {
     return DEP_KEYS.some(key => pkg['.' + key]);
 }
+/** Every file: dep target of a package, by absolute path.
+ *  Looks in the .dependencies backup too, so it finds them whether or not the
+ *  file: paths have been restored yet (--nofiles leaves ^versions in place). */
+function fileDepTargets(pkg, baseDir) {
+    const targets = new Set();
+    for (const key of DEP_KEYS) {
+        for (const source of [pkg[key], pkg['.' + key]]) {
+            if (!source)
+                continue;
+            for (const value of Object.values(source)) {
+                if (isFileRef(value)) {
+                    targets.add(resolveFilePath(value, baseDir));
+                }
+            }
+        }
+    }
+    return [...targets];
+}
+/** Commit (and push) the .globalize.json5 we just wrote in a dependency's repo,
+ *  so the consumer list doesn't sit as an uncommitted change in someone else's
+ *  checkout until their next publish.
+ *
+ *  Stages and commits that one pathspec, never `git add -A`: whatever else the
+ *  dependency's owner had staged or modified stays untouched, so a publish here
+ *  can't sweep up someone else's work in progress. */
+async function commitUpstreamEntry(target, consumer, verbose) {
+    if (!runCommand('git', ['rev-parse', '--git-dir'], { cwd: target, silent: true }).success) {
+        return; // Not a git repo - the file is written, there's nothing to commit
+    }
+    // Stage it first: a config file the dependency has never had before is
+    // untracked, and `git commit -- <path>` rejects a pathspec git doesn't know.
+    const add = runCommand('git', ['add', '--', '.globalize.json5'], { cwd: target, silent: true });
+    if (!add.success) {
+        // Deliberately ignored in that repo - respect it, the file is still written
+        if (/ignored by/i.test(add.stderr + add.output)) {
+            if (verbose)
+                console.log(colors.dim(`  .globalize.json5 is git-ignored in ${target} - not committing`));
+            return;
+        }
+        console.error(colors.yellow(`  Warning: could not stage upstream entry in ${target}: ${add.stderr.trim() || add.output.trim()}`));
+        return;
+    }
+    const commit = runCommand('git', ['commit', '-m', `Record upstream ${consumer}`, '--', '.globalize.json5'], { cwd: target, silent: true });
+    if (!commit.success) {
+        // Re-recording an unchanged entry leaves nothing to commit - not a problem
+        const combined = (commit.output + ' ' + commit.stderr).toLowerCase();
+        if (combined.includes('nothing to commit') || combined.includes('no changes added'))
+            return;
+        console.error(colors.yellow(`  Warning: could not commit upstream entry in ${target}: ${commit.stderr.trim() || commit.output.trim()}`));
+        return;
+    }
+    if (verbose)
+        console.log(colors.dim(`  Committed upstream entry in ${target}`));
+    const hasRemote = runCommand('git', ['remote'], { cwd: target, silent: true }).output.trim().length > 0;
+    if (hasRemote)
+        await pushWithProtection(target, verbose);
+}
+/** Record this package in the `upstream` list of each package it depends on
+ *  via file:, so a library knows who consumes it.
+ *
+ *  Immediate consumers only — each entry's own .globalize.json5 carries its
+ *  consumers, so the full tree is a walk rather than a copy. Nothing acts on
+ *  the list yet; it's FYI for a future "update my consumers" pass.
+ *
+ *  Best-effort: a dep whose config can't be written is reported and skipped,
+ *  never fatal - this runs after a successful publish. */
+export async function recordUpstream(cwd, dryRun = false, verbose = false) {
+    let pkg;
+    try {
+        pkg = readPackageJson(cwd);
+    }
+    catch {
+        return;
+    }
+    const targets = fileDepTargets(pkg, cwd);
+    if (targets.length === 0)
+        return;
+    const entry = {
+        path: path.resolve(cwd),
+        version: pkg.version,
+        updated: new Date().toISOString().slice(0, 10)
+    };
+    for (const target of targets) {
+        try {
+            if (!fs.existsSync(path.join(target, 'package.json')))
+                continue;
+            const targetConfig = readConfig(target);
+            const upstream = [...(targetConfig.upstream ?? [])];
+            // Path identity, case-insensitive: the same checkout reached twice
+            // updates its entry rather than adding a second one.
+            const same = (p) => path.resolve(p).toLowerCase() === entry.path.toLowerCase();
+            const idx = upstream.findIndex(u => same(u.path));
+            if (idx >= 0)
+                upstream[idx] = entry;
+            else
+                upstream.push(entry);
+            if (dryRun) {
+                console.log(`  [dry-run] Would record ${pkg.name}@${entry.version} upstream of ${path.basename(target)}`);
+                continue;
+            }
+            writeConfig(target, { ...targetConfig, upstream });
+            if (verbose) {
+                console.log(colors.dim(`  Recorded upstream ${pkg.name}@${entry.version} in ${target}`));
+            }
+            await commitUpstreamEntry(target, `${pkg.name}@${entry.version}`, verbose);
+        }
+        catch (error) {
+            console.error(colors.yellow(`  Warning: could not record upstream in ${target}: ${error.message}`));
+        }
+    }
+}
 /** Get the latest git tag (if any) */
 export function getLatestGitTag(cwd) {
     try {
@@ -3271,18 +3401,142 @@ export function fixPuppeteerCorruptedCache(combined) {
     }
     return { repaired: [], removed: [] };
 }
-/** npm 11.17+ gates lifecycle scripts behind `allowScripts` — non-covered
- *  scripts are skipped and the install still exits 0. A skipped postinstall
- *  can leave the package broken at runtime (puppeteer without its browser,
- *  native modules unbuilt), so surface the warning instead of burying it in
- *  the captured output. */
-function warnSkippedScripts(combined) {
+// ─── allowScripts policy: trust our own packages, gate everyone else ──
+//
+// npm 11.17+ skips install-time lifecycle scripts (preinstall/install/
+// postinstall) for packages that aren't on an allowlist, and a global
+// install has no project package.json to record approvals in — so a
+// postinstall we wrote ourselves silently never runs while the install
+// still exits 0. (@bobfrankston/msger's postinstall copies its native
+// binary into the per-user bin dir its launcher reads from; skipping it
+// leaves a stale exe behind a green checkmark.)
+//
+// npmglobalize only ever installs a package it just built and published
+// from the user's own source, so own-scope packages are trusted. Third-
+// party deps are not: they stay gated and keep surfacing through
+// warnSkippedScripts. That's deliberately narrower than a blanket
+// --dangerously-allow-all-scripts — it keeps the warning meaningful
+// instead of turning it into dead code.
+//
+// The policy matcher has no scope wildcard (`@scope/*` matches nothing —
+// see arborist's script-allowed.js), so the allowlist must name every
+// own-scope package in the tree explicitly.
+let _allowScriptsSupported = null;
+let _wslAllowScriptsSupported = null;
+/** Probe output for a config key npm doesn't define. */
+const isUnknownConfig = (out) => {
+    const v = out.trim();
+    return v === '' || v === 'undefined';
+};
+/** Does this npm know the allowScripts policy (11.17+)? Older npm runs all
+ *  install scripts unconditionally, and passing the flag there just prints
+ *  "Unknown cli config" on every install. Probed once per process.
+ *
+ *  Probes the boolean sibling flag rather than `allow-scripts` itself: an
+ *  unset list config also prints empty, which is indistinguishable from
+ *  "not supported". Both flags landed in the same npm release. */
+function npmSupportsAllowScripts() {
+    if (_allowScriptsSupported === null) {
+        const r = runCommand('npm', ['config', 'get', 'dangerously-allow-all-scripts'], { silent: true });
+        _allowScriptsSupported = r.success && !isUnknownConfig(r.output);
+    }
+    return _allowScriptsSupported;
+}
+/** Same probe against WSL's npm, which is a separate install and can lag
+ *  behind the Windows one. */
+async function wslNpmSupportsAllowScripts() {
+    if (_wslAllowScriptsSupported === null) {
+        const r = await runCommandAsync('wsl', ['npm', 'config', 'get', 'dangerously-allow-all-scripts'], { silent: true });
+        _wslAllowScriptsSupported = r.success && !isUnknownConfig(r.output);
+    }
+    return _wslAllowScriptsSupported;
+}
+/** Every package in `dir`'s dependency closure that shares its scope — our
+ *  own packages, published by this same tool. Walks node_modules for
+ *  transitive own-scope deps, since a cascade dep can carry its own
+ *  postinstall and only its installed copy lists its dependencies.
+ *
+ *  Returns [] for an unscoped package: there's no way to tell an unscoped
+ *  package of ours from a third-party one by name alone. */
+export function ownScopePackages(dir) {
+    let pkg;
+    try {
+        pkg = readPackageJson(dir);
+    }
+    catch {
+        return [];
+    }
+    const name = pkg.name || '';
+    const slash = name.indexOf('/');
+    if (!name.startsWith('@') || slash < 2)
+        return [];
+    const scope = name.slice(0, slash + 1); // '@bobfrankston/'
+    // npm hoists, so a dep's own deps usually sit in the root node_modules
+    // rather than nested under it — check both.
+    const resolveDep = (dep, from) => {
+        for (const cand of [path.join(from, 'node_modules', dep), path.join(dir, 'node_modules', dep)]) {
+            if (fs.existsSync(path.join(cand, 'package.json')))
+                return cand;
+        }
+        return null;
+    };
+    const found = new Set([name]);
+    const walk = (manifest, from) => {
+        const deps = { ...(manifest.dependencies || {}), ...(manifest.optionalDependencies || {}) };
+        for (const dep of Object.keys(deps)) {
+            if (!dep.startsWith(scope) || found.has(dep))
+                continue;
+            found.add(dep);
+            const depDir = resolveDep(dep, from);
+            if (!depDir)
+                continue; // not installed here — the name is still allowed
+            try {
+                walk(JSON.parse(fs.readFileSync(path.join(depDir, 'package.json'), 'utf-8')), depDir);
+            }
+            catch { /* unreadable dep manifest — the name is still allowed */ }
+        }
+    };
+    walk(pkg, dir);
+    return [...found];
+}
+/** npm args allowing install scripts for our own packages only. Empty when
+ *  npm predates the policy (it runs the scripts anyway) or the package is
+ *  unscoped.
+ *
+ *  Note: the CLI layer *replaces* the .npmrc layer rather than merging with
+ *  it (first source with any config wins, per npm's resolve-allow-scripts),
+ *  so passing this suppresses any allow-scripts entries in .npmrc for this
+ *  install. Third-party approvals therefore belong on the command line too,
+ *  not in .npmrc. */
+function allowOwnScriptsArgs(dir) {
+    if (!npmSupportsAllowScripts())
+        return [];
+    const own = ownScopePackages(dir);
+    return own.length ? ['--allow-scripts', own.join(',')] : [];
+}
+/** A skipped postinstall can leave a package broken at runtime (puppeteer
+ *  without its browser, native modules unbuilt), so surface the warning
+ *  instead of burying it in the captured output. Own-scope packages are
+ *  reported separately and louder: those were supposed to be allowed, so
+ *  one showing up here means the allowlist missed it. */
+function warnSkippedScripts(combined, allowed = []) {
     const pkgs = [...combined.matchAll(/^npm warn allow-scripts\s+(\S+@[^\s(]+) \(/gm)];
     if (!pkgs.length)
         return;
-    const names = pkgs.map(m => m[1].replace(/@[^@]+$/, ''));
-    console.log(colors.yellow(`  ⚠ npm skipped install scripts (allowScripts): ${pkgs.map(m => m[1]).join(', ')}`));
-    console.log(colors.yellow(`    Package may be broken at runtime. Allow with: npm config set allow-scripts=${names.join(',')} --location=user`));
+    const nameOf = (spec) => spec.replace(/@[^@]+$/, '');
+    const first = allowed[0] || '';
+    const scope = first.startsWith('@') ? first.slice(0, first.indexOf('/') + 1) : '';
+    const ours = scope ? pkgs.filter(m => nameOf(m[1]).startsWith(scope)) : [];
+    const others = pkgs.filter(m => !ours.includes(m));
+    if (ours.length) {
+        console.log(colors.red(`  ⚠ Own-scope install scripts still skipped: ${ours.map(m => m[1]).join(', ')}`));
+        console.log(colors.red(`    npmglobalize allowlisted ${allowed.length} own package(s) but missed these — likely transitive deps not present in the local node_modules tree.`));
+    }
+    if (others.length) {
+        const names = [...new Set(others.map(m => nameOf(m[1])))];
+        console.log(colors.yellow(`  ⚠ npm skipped install scripts for third-party packages: ${others.map(m => m[1]).join(', ')}`));
+        console.log(colors.yellow(`    Package may be broken at runtime. Allow with: npm install -g <pkg> --allow-scripts ${names.join(',')}`));
+    }
 }
 /** Run npm install -g with retries for registry propagation delay.
  *  Brand-new packages (first-time publish) take much longer to become
@@ -3301,16 +3555,20 @@ async function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRet
     let result = { success: false, output: '', stderr: '' };
     let attempt = 0;
     let cacheFixRounds = 0;
+    // Our own packages are trusted — we just built and published them from
+    // this very directory — so their install scripts run. Everything else
+    // stays behind npm's allowScripts gate.
+    const allowArgs = allowOwnScriptsArgs(cwd);
     while (true) {
-        console.log(colors.cyan(`> npm install -g ${pkgSpec}`));
-        result = await runCommandAsync('npm', ['install', '-g', pkgSpec], { cwd, silent: true });
+        console.log(colors.cyan(`> npm install -g ${pkgSpec}${allowArgs.length ? ` ${allowArgs.join(' ')}` : ''}`));
+        result = await runCommandAsync('npm', ['install', '-g', pkgSpec, ...allowArgs], { cwd, silent: true });
         const combined = `${result.output}\n${result.stderr}`;
         fullLog += `===== attempt ${attempt + 1}: npm install -g ${pkgSpec} =====\n${combined}\n`;
         if (result.success) {
             const added = combined.match(/^(?:added|changed|removed) \d+ packages?.*$/m);
             if (added)
                 console.log(colors.dim(`  ${added[0]}`));
-            warnSkippedScripts(combined);
+            warnSkippedScripts(combined, allowArgs.length ? allowArgs[1].split(',') : []);
             // A truncated puppeteer browser extraction exits 0, so the install
             // LOOKS fine while the cache is poisoned for every future install.
             // Verify now, while the leftover archive still allows a repair.
@@ -3548,6 +3806,14 @@ async function waitForNpmVersionInWsl(spec, maxWaitMs = 180000) {
     return false;
 }
 export async function installInWsl(wslArgs, opts = {}) {
+    // Same trust rule as the Windows installs: allow our own packages'
+    // install scripts, leave third-party ones gated. Probed against WSL's
+    // npm, which is a separate install from the Windows one.
+    if (opts.cwd && wslArgs.includes('install') && await wslNpmSupportsAllowScripts()) {
+        const own = ownScopePackages(opts.cwd);
+        if (own.length)
+            wslArgs = [...wslArgs, '--allow-scripts', own.join(',')];
+    }
     const runOnce = async () => {
         console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
         const r = await runCommandAsync('wsl', wslArgs, { cwd: opts.cwd, silent: true });
@@ -4035,29 +4301,39 @@ function getAuthInstructions() {
     return `
 Authentication Options:
 
-1. ${colors.yellow('Create a Granular Access Token')} (recommended):
+1. ${colors.yellow('Interactive login')} (recommended):
+   - Run: ${colors.green('npm login')}
+   - Web-based: completes 2FA in the browser and writes the token for you.
+   - The path that survives npm's token changes (see the note below).
+
+2. ${colors.yellow('Create a Granular Access Token')} (unattended use):
    - Go to: https://www.npmjs.com/settings/[username]/tokens
    - Click "Generate New Token" → "Granular Access Token"
    - Set permissions: ${colors.green('Read and write')} for packages
-   - Enable: ${colors.green('Bypass 2FA requirement')} (if available)
-   - Copy the token and save it securely
+   - Scope it to the packages you actually publish, and set an expiry
+   - ${colors.red('Do NOT enable "Bypass 2FA"')} — npm is retiring it:
+       · since early Aug 2026, bypass tokens no longer skip 2FA for token,
+         package-access, maintainer, org or team changes
+       · around Jan 2027, they lose direct publish entirely (read + stage
+         only; publication needs human 2FA approval)
 
-2. ${colors.yellow('Set token via environment variable')}:
+3. ${colors.yellow('Set token via environment variable')}:
    - Set: ${colors.green('NPM_TOKEN=npm_xxx...')}
    - Or run: ${colors.green('$env:NPM_TOKEN="npm_xxx..."')} (PowerShell)
 
-3. ${colors.yellow('Set token in .npmrc')}:
+4. ${colors.yellow('Set token in .npmrc')}:
    - Edit: ${colors.green(npmrcPath)}
    - Add: ${colors.green('//registry.npmjs.org/:_authToken=npm_xxx...')}
 
-4. ${colors.yellow('Use classic login')} (may require 2FA):
-   - Run: ${colors.green('npm login')}
-   - Follow interactive prompts
+5. ${colors.yellow('Publishing from CI')}:
+   - Prefer trusted publishing (OIDC) over any long-lived token — nothing to
+     rotate, and it is the supported path once bypass tokens lose publish.
 
 ${colors.italic('Note: y:\\dev\\utils\\npmglobalize has set-npm-token.ps1 that may help fix token')}
 ${colors.italic('      problems, but no promises.')}
 
-Note: npm now requires either 2FA or a granular token with bypass enabled.
+Note: unattended local publishing with a long-lived token is on a deprecation
+path. Plan for OIDC publishing from CI, or a publish step you approve with 2FA.
 `;
 }
 function loadIgnorePatterns() {
@@ -4989,7 +5265,7 @@ async function doLocalInstall(cwd, options) {
             console.log('  [dry-run] Would run: wsl npm install -g .');
         return true;
     }
-    const result = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+    const result = await runCommandAsync('npm', ['install', '-g', '.', ...allowOwnScriptsArgs(cwd)], { cwd, silent: false, showCommand: true });
     if (result.success) {
         console.log(colors.green(`✓ Installed locally: ${pkgName}@${pkgVersion}`));
     }
@@ -5000,7 +5276,7 @@ async function doLocalInstall(cwd, options) {
     }
     if (wsl) {
         console.log(`Installing ${pkgName} in WSL (local)...`);
-        const wslResult = await runCommandAsync('wsl', ['npm', 'install', '-g', '.'], { cwd, silent: false, showCommand: true });
+        const wslResult = await installInWsl(['npm', 'install', '-g', '.'], { cwd });
         if (wslResult.success) {
             console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}`));
         }
@@ -5105,7 +5381,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log('  [dry-run] Would run: wsl npm install -g .');
             return true;
         }
-        const result = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+        const result = await runCommandAsync('npm', ['install', '-g', '.', ...allowOwnScriptsArgs(cwd)], { cwd, silent: false, showCommand: true });
         if (result.success) {
             console.log(colors.green(`✓ Installed locally: ${pkgName}@${pkgVersion}`));
         }
@@ -5116,7 +5392,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         }
         if (wsl) {
             console.log(`Installing ${pkgName} in WSL (local)...`);
-            const wslResult = runCommand('wsl', ['npm', 'install', '-g', '.'], { cwd, silent: false, showCommand: true });
+            const wslResult = await installInWsl(['npm', 'install', '-g', '.'], { cwd });
             if (wslResult.success) {
                 console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}`));
             }
@@ -7309,6 +7585,9 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     else if (!files) {
         console.log('Keeping npm versions (--nofiles mode).');
     }
+    // Tell each file: dependency that this package consumes it. Runs after the
+    // publish so the version recorded is the one that actually shipped.
+    await recordUpstream(cwd, dryRun, verbose);
     console.log(`${timestamp()} Done!`);
     // Run final audit report if not already run
     const auditAlreadyRun = (fix || updateDeps) && (transformResult.transformed || alreadyTransformed || updateDeps);
@@ -7345,6 +7624,17 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     if (files && transformResult.transformed) {
         console.log(`  Restored file: deps: ${colors.green('✓')}`);
     }
+    // Who consumes what was just published. FYI only - nothing was updated for
+    // them; this is the list you'd walk if you wanted to.
+    {
+        const consumers = readConfig(cwd).upstream ?? [];
+        if (consumers.length > 0) {
+            console.log(`  Upstream consumers (not updated): ${consumers.length}`);
+            for (const c of consumers) {
+                console.log(`    ${colors.dim('·')} ${path.basename(c.path)} v${c.version} ${colors.dim(`(${c.updated}, ${c.path})`)}`);
+            }
+        }
+    }
     // Surface non-default settings the user may have forgotten about
     {
         const surprises = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.196",
+  "version": "1.0.198",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@bobfrankston/freezepak": "^0.1.9",
-    "@bobfrankston/importgen": "^0.1.38",
+    "@bobfrankston/importgen": "^0.1.39",
     "@bobfrankston/themecolors": "^0.1.8",
     "@bobfrankston/userconfig": "^1.0.10",
     "@npmcli/package-json": "^7.0.4",
@@ -60,7 +60,7 @@
   ".transformedSnapshot": {
     "dependencies": {
       "@bobfrankston/freezepak": "^0.1.9",
-      "@bobfrankston/importgen": "^0.1.38",
+      "@bobfrankston/importgen": "^0.1.39",
       "@bobfrankston/themecolors": "^0.1.8",
       "@bobfrankston/userconfig": "^1.0.10",
       "@npmcli/package-json": "^7.0.4",