@bobfrankston/npmglobalize 1.0.235 → 1.0.237

package/README.md

@@ -527,7 +527,7 @@ not what you meant to publish, so npmglobalize lists the conflicted files and st
                 Example: -npm public,ts
 ```
 
-Flipping an already-published package between private and public runs `npm access set`. Since Aug 2026 that fails with a bare 403 when the token in `.npmrc` is a bypass-2FA granular token (npm no longer lets such tokens change package access, and offers no OTP prompt). npmglobalize recognizes that case, says so, and points at the package's Access page on npmjs.com (`https://www.npmjs.com/package/<name>/access`, browser sign-in with 2FA); set the status there and rerun. The finding is repeated in the Issues Summary. Publishing itself is unaffected until the Jan 2027 phase of the same deprecation. (2026-09-23)
+Flipping an already-published package between private and public runs `npm access set`. Since Aug 2026 that fails with a bare 403 when the token in `.npmrc` is a bypass-2FA granular token (npm no longer lets such tokens change package access, and offers no OTP prompt). npmglobalize recognizes that case, says so, and points at the package's Access page on npmjs.com (`https://www.npmjs.com/package/<name>/access`, browser sign-in with 2FA); set the status there and rerun. The failed flip does not stop the publish: the package still goes up with the access npm currently has (the run says so, and the summary reports that access, not the requested one), and the requested visibility stays in `.globalize.json5` so the next run tries the flip again. The finding is repeated in the Issues Summary. Publishing itself is unaffected until the Jan 2027 phase of the same deprecation. (2026-09-23)
 
 `ts` is already the default on git (source is tracked). Pass `-npm ts` to ship
 the same files to npm — useful for debugging installed packages or "source on

package/lib.js

@@ -7993,15 +7993,26 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (currentAccess === 'public') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PUBLIC on npm. Converting to private...`));
             if (!dryRun) {
-                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=restricted', pkg.name], { cwd, silent: false });
+                // 2026-09-23 01:15 EDT — Claude Code (Fable 5.1): silent:true so npm's output is
+                // CAPTURED (stdio 'inherit' captures nothing, and v1.0.235's 403 detection never
+                // fired on httppoly). The captured text is echoed below on failure, so nothing is lost.
+                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=restricted', pkg.name], { cwd, silent: true });
                 if (accessResult.success) {
                     console.log(colors.green(`✓ Changed ${pkg.name} to PRIVATE on npm`));
                     currentAccess = 'restricted';
                 }
                 else {
+                    if (accessResult.stderr.trim())
+                        console.error(colors.dim(accessResult.stderr.trim()));
                     console.error(colors.red(explainAccessChangeFailure(pkg.name, 'restricted', accessResult)));
-                    if (!force)
-                        return false;
+                    // 2026-09-23 01:20 EDT — Claude Code (Fable 5.1), Bob: "even if public fails
+                    // the npm store should still be updated". A failed flip no longer aborts the
+                    // publish: the package goes up with the access npm currently has, and
+                    // effectiveNpmVisibility is downgraded to match so the publish args and the
+                    // summaries report what actually happened. The requested visibility stays in
+                    // .globalize.json5, so the next run tries the flip again.
+                    effectiveNpmVisibility = 'public';
+                    console.log(colors.yellow(`Publishing ${pkg.name} as PUBLIC anyway (its current npm status); set it to private on the website, then rerun.`));
                 }
             }
             else {
@@ -8009,29 +8020,38 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             }
         }
         // Don't set "private": true in package.json - that blocks all publishing
-        console.log(`Package '${pkg.name}' will publish as PRIVATE (restricted access).`);
+        if (effectiveNpmVisibility === 'private')
+            console.log(`Package '${pkg.name}' will publish as PRIVATE (restricted access).`);
     }
     else if (effectiveNpmVisibility === 'public') {
         // User explicitly wants public (or confirmed via prompt)
         if (currentAccess === 'restricted') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PRIVATE on npm. Converting to public...`));
             if (!dryRun) {
-                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=public', pkg.name], { cwd, silent: false });
+                // 2026-09-23 01:15 EDT — Claude Code (Fable 5.1): silent:true to capture npm's
+                // output for the 403 detection; echoed on failure. Same as the restricted branch.
+                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=public', pkg.name], { cwd, silent: true });
                 if (accessResult.success) {
                     console.log(colors.green(`✓ Changed ${pkg.name} to PUBLIC on npm`));
                     currentAccess = 'public';
                 }
                 else {
+                    if (accessResult.stderr.trim())
+                        console.error(colors.dim(accessResult.stderr.trim()));
                     console.error(colors.red(explainAccessChangeFailure(pkg.name, 'public', accessResult)));
-                    if (!force)
-                        return false;
+                    // 2026-09-23 01:20 EDT — Claude Code (Fable 5.1), Bob: "even if public fails
+                    // the npm store should still be updated". Publish with the access npm has now
+                    // (restricted); no --access public is passed and the summaries say PRIVATE. The
+                    // requested visibility stays in .globalize.json5 so the next run retries the flip.
+                    effectiveNpmVisibility = 'private';
+                    console.log(colors.yellow(`Publishing ${pkg.name} as PRIVATE anyway (its current npm status); set it to public on the website, then rerun.`));
                 }
             }
             else {
                 console.log(colors.dim(`  [dry-run] Would run: npm access set status=public ${pkg.name}`));
             }
         }
-        if (!publicConfirmed) {
+        if (!publicConfirmed && effectiveNpmVisibility === 'public') {
             console.log(`Will publish '${pkg.name}' to PUBLIC npm registry.`);
             if (pkg.bin) {
                 console.log(colors.yellow(`  CLI tool - to install globally: npm install -g ${pkg.name}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.235",
+  "version": "1.0.237",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",