@bobfrankston/npmglobalize 1.0.215 → 1.0.216

package/README.md

@@ -562,6 +562,23 @@ Settings can be saved in `.globalize.json5`:
 
 Configuration persists across runs. CLI flags override config file.
 
+### `.stale` — retired directories
+
+A directory that is no longer live or maintained can be retired in place by
+dropping a `.stale` file into it — empty, or better holding one line saying why
+and when. It is a marker file, not a setting in `.globalize.json5`, because
+stale is a property of the directory (most retired directories never had a
+config) and a file is findable without parsing.
+
+npmglobalize refuses to build, publish or install a directory marked `.stale`,
+and refuses to cascade into a `file:` dependency that is marked. Both are
+reported as **errors**, not skips: a live package that depends on a retired one
+has a reference that needs fixing. Remove the marker to make the directory live
+again.
+
+`cleanprev.ps1` (in `%OneDrive%\xfer\bin`) strips `node_modules`, lock files and
+tsc output from every `.stale` directory the same way it does for `prev/`.
+
 ### `usePaths` — Standalone packages
 
 Default: `true`. Set to `false` (or pass `-no-use-paths` / `-nup`) to mark a

package/lib.d.ts

@@ -297,6 +297,15 @@ export type UnpublishedDep = {
  *  NOT `fs.realpathSync.native`: that would also resolve a junction the user is
  *  standing inside, which is a behaviour change nobody asked for. */
 export declare function canonicalCase(target: string): string;
+/** A directory retired in place carries a `.stale` marker file (Bob's convention,
+ *  2026-09-06; `cleanprev.ps1` strips such directories like a `prev/`). The file
+ *  is empty or holds a line saying why and when. Returns that line (or a fixed
+ *  phrase when empty), or null when the directory is not marked.
+ *
+ *  2026-09-06 — Claude Code (Fable 5.1), at Bob's direction. A marker file rather
+ *  than a flag in .globalize.json5: stale is a property of a directory, most stale
+ *  directories never had a config, and a file is findable without parsing. */
+export declare function staleMarker(dir: string): string;
 /** Vet the casing of every `file:` dependency path, in BOTH places it is recorded:
  *  the spec in package.json and the junction npm created in node_modules.
  *

package/lib.js

@@ -1370,6 +1370,25 @@ function caseDiffers(a, b) {
     const strip = (p) => p.replace(/[\\/]+$/, '');
     return strip(a) !== strip(b);
 }
+/** A directory retired in place carries a `.stale` marker file (Bob's convention,
+ *  2026-09-06; `cleanprev.ps1` strips such directories like a `prev/`). The file
+ *  is empty or holds a line saying why and when. Returns that line (or a fixed
+ *  phrase when empty), or null when the directory is not marked.
+ *
+ *  2026-09-06 — Claude Code (Fable 5.1), at Bob's direction. A marker file rather
+ *  than a flag in .globalize.json5: stale is a property of a directory, most stale
+ *  directories never had a config, and a file is findable without parsing. */
+export function staleMarker(dir) {
+    const marker = path.join(dir, '.stale');
+    if (!fs.existsSync(marker))
+        return null;
+    let note = '';
+    try {
+        note = fs.readFileSync(marker, 'utf8').split(/\r?\n/).map(l => l.trim()).find(l => l) || '';
+    }
+    catch { /* unreadable note: still stale */ }
+    return note || 'no reason recorded in .stale';
+}
 /** Vet the casing of every `file:` dependency path, in BOTH places it is recorded:
  *  the spec in package.json and the junction npm created in node_modules.
  *
@@ -2328,6 +2347,15 @@ export async function ensureFileDepModules(cwd, verbose = false, visited = new S
             const target = path.resolve(cwd, spec.slice('file:'.length));
             if (!fs.existsSync(path.join(target, 'package.json')))
                 continue;
+            // 2026-09-06 — Claude Code (Fable 5.1): never install into, or walk
+            // through, a dep that is retired (`.stale`). Reported as an error so the
+            // stale reference in package.json gets fixed rather than papered over.
+            const targetStale = staleMarker(target);
+            if (targetStale) {
+                console.error(colors.red(`✗ file: dependency ${name} -> ${target} is marked .stale (${targetStale}); not installing into a retired directory.`));
+                recordBuildIssue(pkg?.name || abs, 'error', `file: dependency ${name} (${target}) is marked .stale (${targetStale}).`);
+                continue;
+            }
             let targetPkg;
             try {
                 targetPkg = readPackageJson(target);
@@ -3505,7 +3533,7 @@ export async function buildFileDepsTopologically(cwd, opts = {}, visited = new S
         const deps = pkg?.[key];
         if (!deps || typeof deps !== 'object')
             continue;
-        for (const [, spec] of Object.entries(deps)) {
+        for (const [name, spec] of Object.entries(deps)) {
             if (typeof spec !== 'string' || !spec.startsWith('file:'))
                 continue;
             const target = path.resolve(cwd, spec.slice('file:'.length));
@@ -3514,6 +3542,18 @@ export async function buildFileDepsTopologically(cwd, opts = {}, visited = new S
             const targetAbs = path.resolve(target);
             if (visited.has(targetAbs))
                 continue;
+            // 2026-09-06 — Claude Code (Fable 5.1): a retired (`.stale`) dep is not
+            // built. Counts as a failed dep so the consumer's build stops here too,
+            // unless -force says to carry on.
+            const targetStale = staleMarker(target);
+            if (targetStale) {
+                console.error(colors.red(`✗ file: dependency ${name} -> ${target} is marked .stale (${targetStale}); not building a retired directory.`));
+                recordBuildIssue(pkg?.name || abs, 'error', `file: dependency ${name} (${target}) is marked .stale (${targetStale}).`);
+                allOk = false;
+                if (!opts.force)
+                    return false;
+                continue;
+            }
             // Recurse first (deps before consumer)
             const childOk = await buildFileDepsTopologically(target, opts, visited);
             if (!childOk)
@@ -6141,6 +6181,17 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     publishDepsYes = false, // -pd: auto-yes to dep-cascade prompts (private only)
     publicDeps = false, // -public-deps: cascade public visibility to all deps
     noPrescan = false, forcePublish = false, fix = true, fixTags = false, rebase = false, show = false, local = false, freeze = false, usePaths = true, allowTs, adopt = false, importCheck = false } = options;
+    // 2026-09-06 — Claude Code (Fable 5.1), at Bob's direction: a directory marked
+    // `.stale` is retired. Refuse to build, publish or install it — and because the
+    // dep cascade reaches deps through this same function, refuse to cascade into
+    // one too. The refusal is an error, not a skip: a live package depending on a
+    // stale one is a fact the user has to act on.
+    const staleNote = staleMarker(cwd);
+    if (staleNote) {
+        console.error(colors.red(`✗ ${cwd} is marked .stale (${staleNote}). Not publishing a retired directory.`));
+        recordBuildIssue(path.basename(cwd), 'error', `Directory is marked .stale (${staleNote}); remove the marker to publish it again.`);
+        return false;
+    }
     // Show tool version only for recursive dep calls (CLI already prints it at startup)
     const toolVersion = getToolVersion();
     if (!options._fromWorkspace && !options._fromCli) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.215",
+  "version": "1.0.216",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",