@bobfrankston/npmglobalize 1.0.233 → 1.0.234

package/README.md

@@ -94,7 +94,7 @@ Errors abort (unless `--force`); warnings prompt to continue.
 
 An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
-**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan lists every such edge on every run: consumer → dep and range, the `package.json` that holds the range, and — when the same dep is linked as `file:` elsewhere in the graph — the directory of its local source (that package then exists twice). Nothing is asked and the run continues; a range can be deliberate. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not listed. npmglobalize does not rewrite the range: change it to a `file:` path in the named `package.json`, then run `npmglobalize` in that package. (2026-09-21)
+**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan lists every such edge on every run: consumer → dep and range, the `package.json` that holds the range, and — when the same dep is linked as `file:` elsewhere in the graph — the directory of its local source (that package then exists twice). Each finding is repeated as one line in the end-of-run **Issues Summary**, because the prescan block has scrolled away by the time a cascade finishes. Nothing is asked and the run continues; a range can be deliberate. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not listed. npmglobalize does not rewrite the range: change it to a `file:` path in the named `package.json`, then run `npmglobalize` in that package. (2026-09-21)
 
 Skip the prescan with `-no-prescan` / `-nps`.
 

package/lib.js

@@ -2123,6 +2123,12 @@ export function reportRegistryRefs(registryRefs, fileTargets) {
         if (localSource) {
             console.log(colors.dim(`       local source, linked as file: elsewhere in this graph: ${localSource}`));
         }
+        // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("it should summarize the
+        // findings at the end"). The block above prints before the cascade and scrolls away, so
+        // each finding also goes into the Issues Summary cli.ts prints on every exit path. One
+        // self-contained line: it has to make sense with the prescan output long gone.
+        recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} is installed from npm, not file: — ${path.join(ref.path, 'package.json')}`
+            + (localSource ? ` (local source: ${localSource})` : ''));
     }
     console.log(colors.dim(`  To link one, set it to a file: path in the package.json named above, then run npmglobalize in that package.`));
     console.log('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.233",
+  "version": "1.0.234",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",