@bobfrankston/npmglobalize 1.0.233 → 1.0.235

package/README.md

@@ -94,7 +94,7 @@ Errors abort (unless `--force`); warnings prompt to continue.
 
 An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
-**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan lists every such edge on every run: consumer → dep and range, the `package.json` that holds the range, and — when the same dep is linked as `file:` elsewhere in the graph — the directory of its local source (that package then exists twice). Nothing is asked and the run continues; a range can be deliberate. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not listed. npmglobalize does not rewrite the range: change it to a `file:` path in the named `package.json`, then run `npmglobalize` in that package. (2026-09-21)
+**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan lists every such edge on every run: consumer → dep and range, the `package.json` that holds the range, and — when the same dep is linked as `file:` elsewhere in the graph — the directory of its local source (that package then exists twice). Each finding is repeated as one line in the end-of-run **Issues Summary**, because the prescan block has scrolled away by the time a cascade finishes. Nothing is asked and the run continues; a range can be deliberate. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not listed. npmglobalize does not rewrite the range: change it to a `file:` path in the named `package.json`, then run `npmglobalize` in that package. (2026-09-21)
 
 Skip the prescan with `-no-prescan` / `-nps`.
 
@@ -527,6 +527,8 @@ not what you meant to publish, so npmglobalize lists the conflicted files and st
                 Example: -npm public,ts
 ```
 
+Flipping an already-published package between private and public runs `npm access set`. Since Aug 2026 that fails with a bare 403 when the token in `.npmrc` is a bypass-2FA granular token (npm no longer lets such tokens change package access, and offers no OTP prompt). npmglobalize recognizes that case, says so, and points at the package's Access page on npmjs.com (`https://www.npmjs.com/package/<name>/access`, browser sign-in with 2FA); set the status there and rerun. The finding is repeated in the Issues Summary. Publishing itself is unaffected until the Jan 2027 phase of the same deprecation. (2026-09-23)
+
 `ts` is already the default on git (source is tracked). Pass `-npm ts` to ship
 the same files to npm — useful for debugging installed packages or "source on
 demand" packages. `noEmit` projects automatically ship `.ts` files (they *are*

package/lib.js

@@ -1088,7 +1088,7 @@ export async function cascadePublicVisibility(cwd, opts = {}) {
                                         console.log(colors.green(`  ✓ Flipped ${targetName} to PUBLIC on npm`));
                                     }
                                     else {
-                                        blockers.push({ name: targetName, reason: `npm access set failed: ${r.stderr || r.output || 'unknown'}` });
+                                        blockers.push({ name: targetName, reason: explainAccessChangeFailure(targetName, 'public', r) });
                                     }
                                 }
                                 else {
@@ -2123,6 +2123,12 @@ export function reportRegistryRefs(registryRefs, fileTargets) {
         if (localSource) {
             console.log(colors.dim(`       local source, linked as file: elsewhere in this graph: ${localSource}`));
         }
+        // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("it should summarize the
+        // findings at the end"). The block above prints before the cascade and scrolls away, so
+        // each finding also goes into the Issues Summary cli.ts prints on every exit path. One
+        // self-contained line: it has to make sense with the prescan output long gone.
+        recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} is installed from npm, not file: — ${path.join(ref.path, 'package.json')}`
+            + (localSource ? ` (local source: ${localSource})` : ''));
     }
     console.log(colors.dim(`  To link one, set it to a file: path in the package.json named above, then run npmglobalize in that package.`));
     console.log('');
@@ -6101,6 +6107,24 @@ function checkNpmAuth() {
         return { authenticated: false, error: error.message };
     }
 }
+/** Explain a failed `npm access set status=...` and say what will actually work.
+ *  2026-09-23 01:10 EDT — Claude Code (Fable 5.1), at Bob's direction. Since early Aug
+ *  2026 a granular token that bypasses 2FA no longer covers package-access changes
+ *  (https://gh.io/npm-gat-bypass2fa-deprecation): the registry answers the access POST
+ *  with a bare 403 and npm never offers an OTP prompt. The old message here said "Try
+ *  manually: npm access set ..." — the same command with the same token, which fails
+ *  the same way. The path that works is the package's Access page on npmjs.com, signed
+ *  in with 2FA. Recorded as a build issue too, so it survives to the Issues Summary. */
+function explainAccessChangeFailure(name, status, result) {
+    const text = `${result.stderr}\n${result.output}`;
+    const tokenBlocked = /\bE?403\b/.test(text) && /\/access\b/.test(text);
+    const page = `https://www.npmjs.com/package/${name}/access`;
+    const message = tokenBlocked
+        ? `Cannot change ${name} to ${status} with the npm token in .npmrc (403 on the access endpoint): since Aug 2026 bypass-2FA tokens no longer cover access changes. Set Package Status on ${page} (browser, 2FA), then rerun.`
+        : `Failed to change ${name} to ${status}. Try manually: npm access set status=${status} ${name} (or on ${page}).`;
+    recordBuildIssue(name, 'error', message);
+    return message;
+}
 /** Get authentication setup instructions */
 function getAuthInstructions() {
     const npmrcPath = path.join(process.env.USERPROFILE || process.env.HOME || '~', '.npmrc');
@@ -7975,7 +7999,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     currentAccess = 'restricted';
                 }
                 else {
-                    console.error(colors.red(`Failed to change access. Try manually: npm access set status=restricted ${pkg.name}`));
+                    console.error(colors.red(explainAccessChangeFailure(pkg.name, 'restricted', accessResult)));
                     if (!force)
                         return false;
                 }
@@ -7998,7 +8022,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     currentAccess = 'public';
                 }
                 else {
-                    console.error(colors.red(`Failed to change access. Try manually: npm access set status=public ${pkg.name}`));
+                    console.error(colors.red(explainAccessChangeFailure(pkg.name, 'public', accessResult)));
                     if (!force)
                         return false;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.233",
+  "version": "1.0.235",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",