@bobfrankston/npmglobalize 1.0.234 → 1.0.236

package/README.md

@@ -527,6 +527,8 @@ not what you meant to publish, so npmglobalize lists the conflicted files and st
                 Example: -npm public,ts
 ```
 
+Flipping an already-published package between private and public runs `npm access set`. Since Aug 2026 that fails with a bare 403 when the token in `.npmrc` is a bypass-2FA granular token (npm no longer lets such tokens change package access, and offers no OTP prompt). npmglobalize recognizes that case, says so, and points at the package's Access page on npmjs.com (`https://www.npmjs.com/package/<name>/access`, browser sign-in with 2FA); set the status there and rerun. The finding is repeated in the Issues Summary. Publishing itself is unaffected until the Jan 2027 phase of the same deprecation. (2026-09-23)
+
 `ts` is already the default on git (source is tracked). Pass `-npm ts` to ship
 the same files to npm — useful for debugging installed packages or "source on
 demand" packages. `noEmit` projects automatically ship `.ts` files (they *are*

package/lib.js

@@ -1088,7 +1088,7 @@ export async function cascadePublicVisibility(cwd, opts = {}) {
                                         console.log(colors.green(`  ✓ Flipped ${targetName} to PUBLIC on npm`));
                                     }
                                     else {
-                                        blockers.push({ name: targetName, reason: `npm access set failed: ${r.stderr || r.output || 'unknown'}` });
+                                        blockers.push({ name: targetName, reason: explainAccessChangeFailure(targetName, 'public', r) });
                                     }
                                 }
                                 else {
@@ -6107,6 +6107,24 @@ function checkNpmAuth() {
         return { authenticated: false, error: error.message };
     }
 }
+/** Explain a failed `npm access set status=...` and say what will actually work.
+ *  2026-09-23 01:10 EDT — Claude Code (Fable 5.1), at Bob's direction. Since early Aug
+ *  2026 a granular token that bypasses 2FA no longer covers package-access changes
+ *  (https://gh.io/npm-gat-bypass2fa-deprecation): the registry answers the access POST
+ *  with a bare 403 and npm never offers an OTP prompt. The old message here said "Try
+ *  manually: npm access set ..." — the same command with the same token, which fails
+ *  the same way. The path that works is the package's Access page on npmjs.com, signed
+ *  in with 2FA. Recorded as a build issue too, so it survives to the Issues Summary. */
+function explainAccessChangeFailure(name, status, result) {
+    const text = `${result.stderr}\n${result.output}`;
+    const tokenBlocked = /\bE?403\b/.test(text) && /\/access\b/.test(text);
+    const page = `https://www.npmjs.com/package/${name}/access`;
+    const message = tokenBlocked
+        ? `Cannot change ${name} to ${status} with the npm token in .npmrc (403 on the access endpoint): since Aug 2026 bypass-2FA tokens no longer cover access changes. Set Package Status on ${page} (browser, 2FA), then rerun.`
+        : `Failed to change ${name} to ${status}. Try manually: npm access set status=${status} ${name} (or on ${page}).`;
+    recordBuildIssue(name, 'error', message);
+    return message;
+}
 /** Get authentication setup instructions */
 function getAuthInstructions() {
     const npmrcPath = path.join(process.env.USERPROFILE || process.env.HOME || '~', '.npmrc');
@@ -7975,13 +7993,18 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (currentAccess === 'public') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PUBLIC on npm. Converting to private...`));
             if (!dryRun) {
-                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=restricted', pkg.name], { cwd, silent: false });
+                // 2026-09-23 01:15 EDT — Claude Code (Fable 5.1): silent:true so npm's output is
+                // CAPTURED (stdio 'inherit' captures nothing, and v1.0.235's 403 detection never
+                // fired on httppoly). The captured text is echoed below on failure, so nothing is lost.
+                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=restricted', pkg.name], { cwd, silent: true });
                 if (accessResult.success) {
                     console.log(colors.green(`✓ Changed ${pkg.name} to PRIVATE on npm`));
                     currentAccess = 'restricted';
                 }
                 else {
-                    console.error(colors.red(`Failed to change access. Try manually: npm access set status=restricted ${pkg.name}`));
+                    if (accessResult.stderr.trim())
+                        console.error(colors.dim(accessResult.stderr.trim()));
+                    console.error(colors.red(explainAccessChangeFailure(pkg.name, 'restricted', accessResult)));
                     if (!force)
                         return false;
                 }
@@ -7998,13 +8021,17 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (currentAccess === 'restricted') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PRIVATE on npm. Converting to public...`));
             if (!dryRun) {
-                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=public', pkg.name], { cwd, silent: false });
+                // 2026-09-23 01:15 EDT — Claude Code (Fable 5.1): silent:true to capture npm's
+                // output for the 403 detection; echoed on failure. Same as the restricted branch.
+                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=public', pkg.name], { cwd, silent: true });
                 if (accessResult.success) {
                     console.log(colors.green(`✓ Changed ${pkg.name} to PUBLIC on npm`));
                     currentAccess = 'public';
                 }
                 else {
-                    console.error(colors.red(`Failed to change access. Try manually: npm access set status=public ${pkg.name}`));
+                    if (accessResult.stderr.trim())
+                        console.error(colors.dim(accessResult.stderr.trim()));
+                    console.error(colors.red(explainAccessChangeFailure(pkg.name, 'public', accessResult)));
                     if (!force)
                         return false;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.234",
+  "version": "1.0.236",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",